6

I have Forms authentication and I need a custom object to be stored in HttpContext.Current.User and in Thread.CurrentPrincipal.

To get this, I listen to PostAuthenticateRequest event, then read from the DB all the user data I need to be stored in HttpContext.Current.User and in Thread.CurrentPrincipal, then I instantiate custom IPrincipal and IIdentity objects and assign them to the above locations.

The problem is that for some reason PostAuthenticateRequest fires several times for a single request.. This causes unnecessary DB roundtrips that hurt performance..

How should I address this? (ASP.NET MVC 2)

Thanks.

Ant
  • 181
  • 2
  • 14

2 Answers2

5

Are you sure that it is running several times for a single request? Remember, every resource such as images and style sheets referenced on your page will trigger this event as they are treated as seperate requests. You are best advised to briefly cache the custom objects and check for their existence in the cache and only going to the DB if not there.

You will need to implement some locking on the cache as these requests typically happen very close together.

Daniel Dyson
  • 13,192
  • 6
  • 42
  • 73
  • Oh, yeah! The thing with resources and etc slipped my mind!!! Thanks for the refresher! I've already considered caching. But it also goes with implications. For instance, I read from the DB and store in Principal user's permissions. Having them in cache is not very good idea in case Admin decides to change permission for a user - cached user's permissions won't be updated until the user logs off/log on.. Need to try your idea with "brief" caching. It looks like it should fit the bill.. Thanks a lot! – Ant Jul 07 '10 at 15:23
  • You could update the cache for the current user on Page_Init. Then it would be reloaded from the DB only once per page request. This will always occur before any of the other resorces are requested because the page hasn't been rendered yet. – Daniel Dyson Jul 07 '10 at 15:27
  • @Daniel Dyson, Thanks for the support. So, will the Application_PostAuthenticateRequest() will always be called for each and every resource to get loaded??? – Deepak Tatyaji Ahire Aug 13 '18 at 10:38
  • @Deepak Yes, that is my understanding although I haven't done any webforms since around the time this original post was made. I recall that every resource request that is served through the asp.net pipeline will authenticate. You could easily test this with test page, a number of known resources such as images, js and css files and then set a breakpoint in the Application_PostAuthenticateRequest() handler. Count the times it is hit and you have your answer. – Daniel Dyson Aug 14 '18 at 20:00
  • @Daniel Dyson, Cool idea. Inspired. Thanks. – Deepak Tatyaji Ahire Aug 15 '18 at 07:11
1

Just use the tag in your web.config to remove any authentication from your scripts, css and image directories. For example:

<system.web>
...
</system.web>

<location path="~/Scripts">
   <system.web>
      <authorization>
         <allow users="*"/>
      </authorization>
   </system.web>   
</location>
Pharcyde
  • 173
  • 5
  • 2
    It won't help cause this event fires on each request no matter if you access page that is resctricted or not. – jlp Apr 28 '11 at 14:19