http.context.user 和 thread.currentprincipal 之间的区别以及何时使用它们?

编程入门行业动态更新时间:2024-10-24 20:24:16

本文介绍了http.context.user 和 thread.currentprincipal 之间的区别以及何时使用它们?的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！问题描述

我最近遇到了在 Visual Studio 2008 下运行 asp Web 应用程序的问题.我收到错误消息成员...customUserPrincipal 的类型未解析".跟踪各种讨论组，当您针对 Thread.CurrentPrincipal 分配自定义主体时，Visual Studio 的 Web 服务器似乎存在问题.

在我的代码中，我现在使用...

HttpContext.Current.User = myCustomPrincipal//Thread.CurrentPrincipal = myCustomPrincipal

我很高兴我排除了错误，但这引出了一个问题:这两种设置委托人的方法有什么区别?".还有其他 stackoverflow 问题与差异，但他们没有深入探讨这两种方法的细节.

我确实找到了一篇引人入胜的帖子，其中有以下宏大的评论，但没有解释来支持他的断言......

对所有用户使用 HttpConext.Current.User网络 (ASPX/ASMX) 应用程序.

对所有人使用 Thread.CurrentPrincipal其他应用程序，如 winForms，控制台和 Windows 服务应用程序.

你们中的任何一位安全/dot 专家能否对此主题有所了解?

解决方案

在 webforms 应用程序下，我相信 Thread.CurrentPrincipal 将成为运行工作进程 (Thread) 的主体.>

HttpContext.Current.User 将是当前登录的网络用户.

在表单/wpf 应用程序的情况下，这是有道理的，因为您正在运行应用程序的用户是您感兴趣的用户.

你是想伪装工作进程还是登录用户?

I have just recently run into an issue running an asp web app under visual studio 2008. I get the error 'type is not resolved for member...customUserPrincipal'. Tracking down various discussion groups it seems that there is an issue with Visual Studio's web server when you assign a custom principal against the Thread.CurrentPrincipal.

In my code, I now use...

HttpContext.Current.User = myCustomPrincipal //Thread.CurrentPrincipal = myCustomPrincipal

I'm glad that I got the error out of the way, but it begs the question "What is the difference between these two methods of setting a principal?". There are other stackoverflow questions related to the differences but they don't get into the details of the two approaches.

I did find one tantalizing post that had the following grandiose comment but no explanation to back up his assertions...

Use HttpConext.Current.User for all web (ASPX/ASMX) applications.

Use Thread.CurrentPrincipal for all other applications like winForms, console and windows service applications.

Can any of you security/dot gurus shed some light on this subject?

解决方案

Under a webforms application I believe Thread.CurrentPrincipal will be the principal for whomever is running the worker process (Thread).

HttpContext.Current.User will be the current logged in web-user.

In the case of a forms/wpf app it makes sense because the user you're running the application under is the one you're interested in.