What is Thread.CurrentPrincipal, and what does it do?

asp.net security c#-4.0 iprincipal iidentity
user1844634 picture user1844634 · Jan 22, 2016 · Viewed 12.8k times · Source

What is Thread.CurrentPrincipal used for? How does it help in the Authentication and Authorization of an application? Are there any articles or resources that help explain what it does?

Answer

MvdD picture MvdD · Jan 23, 2016

Thread.CurrentPrincipal is the way .NET applications represent the identity of the user or service account running the process.

It can hold one or more identities and allows the application to check if the principal is in a role through the IsInRole method.

Most authentication libraries in .NET will verify the user's credentials and set this static property on the Thread class to a new principal object.

Different threads can have different principals as they may be handling requests from different users (in ASP.NET web applications HttpContext.User is copied into Thread.CurrentPrincipal for each new request)

Since .NET 4.5, all principal classes derive from ClaimsPrincipal, enabling claims based authentication.

UPDATE: This is what a WindowsPrincipal looks like on my dev box: enter image description here

Related questions

What are all the user accounts for IIS/ASP.NET and how do they differ?

Under Windows Server 2008 with ASP.NET 4.0 installed there is a whole slew of related user accounts, and I can't understand which one is which, how to they differ, and which one is REALLY the one that my app runs under. …

Read More
X-Frame-Options Allow-From multiple domains

I have an ASP.NET 4.0 IIS7.5 site which I need secured using the X-Frame-Options header. I also need to enable my site pages to be iframed from my same domain as well as from my facebook app. Currently I have …

Read More
ASP.NET Identity's default Password Hasher - How does it work and is it secure?

I am wondering wether the Password Hasher that is default implemented in the UserManager that comes with MVC 5 and ASP.NET Identity Framework, is secure enough? And if so, if you could explain to me how it works? IPasswordHasher interface …

Read More