认识HttpContext.User

namespaceSystem.Security.Principal
{
///<summary>Definesthebasicfunctionalityofaprincipalobject.</summary>
[__DynamicallyInvokable,ComVisible(true)]
publicinterfaceIPrincipal
{
///<summary>Getstheidentityofthecurrentprincipal.</summary>
///<returns>The<seecref="T:System.Security.Principal.IIdentity"/>objectassociatedwiththecurrentprincipal.</returns>
[__DynamicallyInvokable]
IIdentityIdentity
{
[__DynamicallyInvokable]
get;
}
///<summary>Determineswhetherthecurrentprincipalbelongstothespecifiedrole.</summary>
///<returns>trueifthecurrentprincipalisamemberofthespecifiedrole;otherwise,false.</returns>
///<paramname="role">Thenameoftheroleforwhichtocheckmembership.</param>
[__DynamicallyInvokable]
boolIsInRole(stringrole);
}
}

IPrincipal.Identity属性(只读)
.net源代码

///<summary>Definesthebasicfunctionalityofanidentityobject.</summary>
[__DynamicallyInvokable,ComVisible(true)]
publicinterfaceIIdentity
{
///<summary>Getsthenameofthecurrentuser.</summary>
///<returns>Thenameoftheuseronwhosebehalfthecodeisrunning.</returns>
[__DynamicallyInvokable]
stringName
{
[__DynamicallyInvokable]
get;
}
///<summary>Getsthetypeofauthenticationused.</summary>
///<returns>Thetypeofauthenticationusedtoidentifytheuser.</returns>
[__DynamicallyInvokable]
stringAuthenticationType
{
[__DynamicallyInvokable]
get;
}
///<summary>Getsavaluethatindicateswhethertheuserhasbeenauthenticated.</summary>
///<returns>trueiftheuserwasauthenticated;otherwise,false.</returns>
[__DynamicallyInvokable]
boolIsAuthenticated
{
[__DynamicallyInvokable]
get;
}
}

MVC的授权过滤器AuthorizeAttribute，即利用了Httpcontext.User来验证当前请求是否已被认证。
.net源代码如下

publicclassAuthorizeAttribute:FilterAttribute,IAuthorizationFilter
{
protectedvirtualboolAuthorizeCore(HttpContextBasehttpContext)
{
if(httpContext==null)
{
thrownewArgumentNullException("httpContext");
}
IPrincipaluser=httpContext.User;
returnuser.Identity.IsAuthenticated&&(this._usersSplit.Length<=0||this._usersSplit.Contains(user.Identity.Name,StringComparer.OrdinalIgnoreCase))&&(this._rolesSplit.Length<=0||this._rolesSplit.Any(newFunc<string,bool>(user.IsInRole)));
}
}