What is the difference between the following two ways to access a principle through an AuthorizeAttribute implementation?
Using HttpContext :
protected override bool IsAuthorized(HttpActionContext actionContext) { return HttpContext.Current.User.IsInRole("DemoRole"); }
Using HttpActionContext :
protected override bool IsAuthorized(HttpActionContext actionContext) { return actionContext.RequestContext.Principal.IsInRole("DemoRole"); }
source share