The main different is speed.
The Request.IsAuthenticated
is faster and use an internal cache flag, than the Membership.GetUser()
.
To see why the one is faster than the other I place here the code.
public virtual bool IsAuthenticated
{
get
{
if (this.m_isAuthenticated == -1)
{
WindowsPrincipal principal = new WindowsPrincipal(this);
SecurityIdentifier sid = new SecurityIdentifier(IdentifierAuthority.NTAuthority, new int[] { 11 });
this.m_isAuthenticated = principal.IsInRole(sid) ? 1 : 0;
}
return (this.m_isAuthenticated == 1);
}
}
but the GetUser()
have too many calls because actually need more information's to give.
public static MembershipUser GetUser()
{
return GetUser(GetCurrentUserName(), true);
}
private static string GetCurrentUserName()
{
if (HostingEnvironment.IsHosted)
{
HttpContext current = HttpContext.Current;
if (current != null)
{
return current.User.Identity.Name;
}
}
IPrincipal currentPrincipal = Thread.CurrentPrincipal;
if ((currentPrincipal != null) && (currentPrincipal.Identity != null))
{
return currentPrincipal.Identity.Name;
}
return string.Empty;
}
public static MembershipUser GetUser(string username, bool userIsOnline)
{
SecUtility.CheckParameter(ref username, true, false, true, 0, "username");
return Provider.GetUser(username, userIsOnline);
}
internal static void CheckParameter(ref string param, bool checkForNull, bool checkIfEmpty, bool checkForCommas, int maxSize, string paramName)
{
if (param == null)
{
if (checkForNull)
{
throw new ArgumentNullException(paramName);
}
}
else
{
param = param.Trim();
if (checkIfEmpty && (param.Length < 1))
{
throw new ArgumentException(SR.GetString("Parameter_can_not_be_empty", new object[] { paramName }), paramName);
}
if ((maxSize > 0) && (param.Length > maxSize))
{
throw new ArgumentException(SR.GetString("Parameter_too_long", new object[] { paramName, maxSize.ToString(CultureInfo.InvariantCulture) }), paramName);
}
if (checkForCommas && param.Contains(","))
{
throw new ArgumentException(SR.GetString("Parameter_can_not_contain_comma", new object[] { paramName }), paramName);
}
}
}
IsAuthenticated
is done IN THE SAME REQUEST. If this is so, why the user is not immediately logged out, after deleted from the database?