Collectives™ on Stack Overflow

Find centralized, trusted content and collaborate around the technologies you use most.

Teams

Q&A for work

Connect and share knowledge within a single location that is structured and easy to search.

I am currently working with some legacy code in which the HttpContext.Current.User property is used within an MVC controller method to perform some basic authorization on the current user. From reading the documentation there is also an HttpContext.User property and they both seem to indicate that they can get/set the current user. I'm curious if at some levels they are interchangeable and the same, or if there is a key difference between the 2 that would cause unintended issues in terms of authorizing or even recognizing the current user of the web application.

You cannot refer to HttpContext.User directly, except perhaps inside of a controller. User is a property of the HttpContext class. You can do something like this:

HttpContext context = HttpContext.Current;
IPrincipal user = context.User;
that is, you can refer to the property through an instance of the HttpContext class.
The base Controller class has a property named HttpContext. Inside of a controller, if you reference HttpContext.User, you are referencing base.HttpContext.User, which will generally (always?) be the same thing as HttpContext.Current.User, simply because base.HttpContext will generally (maybe always?) be the same thing as HttpContext.Current.
The documentation sort of explains this (emphasis added, and although this is referring to web forms I believe the principle is the same in MVC):
Because ASP.NET pages contain a default reference to the System.Web
namespace (which contains the HttpContext class), you can reference
the members of HttpContext on an .aspx page without using the fully
qualified class reference to HttpContext. For example, you can use
User.Identity.Name to get the name of the user on whose behalf the
current process is running.
However, if you want to use the members of
IPrincipal from an ASP.NET code-behind module, you must include a
reference to the System.Web namespace in the module and a fully
qualified reference to both the currently active request/response
context and the class in System.Web that you want to use
For example,
in a code-behind page you must specify the fully qualified name
HttpContext.Current.User.Identity.Name.
Both HttpContext.Current and HttpContext are the same as it's returning httpContext object for the current HTTP request.

But the later one is the property of the controller object, so it's available ONLY in a controller.

        
Thanks for contributing an answer to Stack Overflow!
Please be sure to answer the question. Provide details and share your research!
But avoid …
Asking for help, clarification, or responding to other answers.
Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.