Problem with HttpContext.Current.User.Identity.Name

Question

In an environment where about 100 users connect to the site using forms authentication, calling HttpContext.Current.User.Identity.Name returns a correctly registered user.

However, in 10% of cases, incorrect information about the full username is returned. I have never had such a problem on my test machine, this only happens in production. I cannot recreate the same environment with many users on my test machine.

The logic of this application:

1) The user enters the username and passes, the information is viewed using a SQL DB call, if it is a match, the user is authenticated through FormsAuthentication.RedirectFromLoginPage (username, false)

FormsAuthentication.SetAuthCookie(user.SYS_Users_ID.ToString(), false); if (Request["ReturnURL"] == null) FormsAuthentication.RedirectFromLoginPage(user.SYS_Users_ID.ToString(), false); else Response.Redirect("/" + SysConfig.ApplicationName + appConfig.DefaultPages.DefaultPage); 

2) After redirecting, I put the full username in a hidden field

 if (!IsPostBack) userFullName.Value = Helper.GetCurrentUserFullName(); ... public static string GetCurrentUserFullName() { string _userFullName = string.Empty; try { _userFullName = new AgrotMasofim.DAL.Users.Users().GetUserFullName(GetCurrentUserID()); } catch (Exception ex) { Logs.WriteToFileLog(string.Empty,ex); } return _userFullName; } public static Decimal GetCurrentUserID() { Decimal _userID = 0; if (HttpContext.Current.User != null) { try { _userID = Convert.ToDecimal(HttpContext.Current.User.Identity.Name); } catch (Exception ex) { Logs.WriteToFileLog(string.Empty, ex); } } return _userID; } 

3) On all pages visited by the user, his / her information is displayed inside the label, which is located on the main page

  lblUserName.Text = HttpUtility.HtmlDecode("Hello " + userFullName.Value); 

It works almost all the time. Any ideas why this might be from time to time?

Answer 1

Lacking more code, I can only guess about your problem. Since other people may find your question and have similar problems, I guess your problem is the misuse of static classes or properties.

Your GetCurrentUserFullName() method can rely on a data access method that is statically distributed between all threads. In the data access class (s), a race condition may exist that sometimes leads to the identifier of the user being searched being replaced with another request before receiving the data. The solution to this is either (a) using locks in all critical sections of your data access class, or (b) using a solution that creates an instance of a new data access class (s) for each request (indeed, every unit of work). The latter design requires your data access class to be lightweight, but preferable, as it will be easier to test.

It is also possible if you cache values ​​in static properties or other static classes that will be shared between threads, then you have a similar race condition in which these values ​​are cached and used. Similar solutions will be applied - using blocking or using instances on the stream, not static instances.