1

I'm using ASP.NET Membership. If all I ever care about is whether or not I have a non-null Membership.GetUser(), is there ever a reason to use Request.IsAuthenticated?

During development, I have inadvertently created situations where Request.IsAuthenticated is true, but Membership.GetUser() is null, so I would pass the [Authorize] filter test (which is applied globally, with [AllowAnonymous] applied specifically as required), but fail later on. While this is a situation that would probably not occur in production, I'd still like to account for it.

Given this, would it be appropriate to write a custom filter, say AuthorizeMembership or some such, that checks against Membership.GetUser() rather than Request.IsAuthenticated? Any gotchas to be aware of?

If so, would it also be okay to use that filter to populate a global UserInfo object with the user properties I typically need to process a request? I don't use Membership Profile at all, but manage my user properties independently in a separate application database.

3
  • You probably would have to elaborate more on these "situations". Code examples would also be helpful. Because it seems that it is your code to create such unpexpected situations and instead of avoiding them, you try to find out a worse workaround. Jul 4, 2012 at 17:59
  • @Wiktor, the situations aren't created in my code. If the user was logged in and then externally deleted from Membership, Request.IsAuthenticated will be true, but GetUser() will be null. Is code required in order to answer the first question? Not sure what I should provide there since I'm asking about what I should write (if I want authorization to be GetUser()-centric rather than IsAuthenticated-centric), not what I have written.
    – osoviejo
    Jul 4, 2012 at 18:38
  • From what you write I understand that the problem occurs ONLY if the current user is deleted from the database and then a call to the IsAuthenticated is done IN THE SAME REQUEST. If this is so, why the user is not immediately logged out, after deleted from the database? Jul 4, 2012 at 19:46

1 Answer 1

0

The main different is speed.

The Request.IsAuthenticated is faster and use an internal cache flag, than the Membership.GetUser().

To see why the one is faster than the other I place here the code.

public virtual bool IsAuthenticated
{
    get
    {
        if (this.m_isAuthenticated == -1)
        {
            WindowsPrincipal principal = new WindowsPrincipal(this);
            SecurityIdentifier sid = new SecurityIdentifier(IdentifierAuthority.NTAuthority, new int[] { 11 });
            this.m_isAuthenticated = principal.IsInRole(sid) ? 1 : 0;
        }
        return (this.m_isAuthenticated == 1);
    }
}

but the GetUser() have too many calls because actually need more information's to give.

public static MembershipUser GetUser()
{
    return GetUser(GetCurrentUserName(), true);
}

private static string GetCurrentUserName()
{
    if (HostingEnvironment.IsHosted)
    {
        HttpContext current = HttpContext.Current;
        if (current != null)
        {
            return current.User.Identity.Name;
        }
    }
    IPrincipal currentPrincipal = Thread.CurrentPrincipal;
    if ((currentPrincipal != null) && (currentPrincipal.Identity != null))
    {
        return currentPrincipal.Identity.Name;
    }
    return string.Empty;
}

public static MembershipUser GetUser(string username, bool userIsOnline)
{
    SecUtility.CheckParameter(ref username, true, false, true, 0, "username");
    return Provider.GetUser(username, userIsOnline);
}

internal static void CheckParameter(ref string param, bool checkForNull, bool checkIfEmpty, bool checkForCommas, int maxSize, string paramName)
{
    if (param == null)
    {
        if (checkForNull)
        {
            throw new ArgumentNullException(paramName);
        }
    }
    else
    {
        param = param.Trim();
        if (checkIfEmpty && (param.Length < 1))
        {
            throw new ArgumentException(SR.GetString("Parameter_can_not_be_empty", new object[] { paramName }), paramName);
        }
        if ((maxSize > 0) && (param.Length > maxSize))
        {
            throw new ArgumentException(SR.GetString("Parameter_too_long", new object[] { paramName, maxSize.ToString(CultureInfo.InvariantCulture) }), paramName);
        }
        if (checkForCommas && param.Contains(","))
        {
            throw new ArgumentException(SR.GetString("Parameter_can_not_contain_comma", new object[] { paramName }), paramName);
        }
    }
}
1
  • Thanks Aristos. So since IsAuthenticated is cheap and GetUser() is not, it would be worthwhile to always gate GetUser() with an IsAuthenticated check, to avoid the GetUser() work if it's just going to return null, correct? If I implement this in an authorization filter, can I grab all the user info I'm interested in (if GetUser() is non-null) and expose that in an object instance to the controller?
    – osoviejo
    Jul 4, 2012 at 21:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.