Ok well

public string GetMyUserName()
{
Guid MyGuid = Guid.Empty;
string MyUserName = string.Empty;

MyGuid = SecurityUtility.GetUserId();

if (MyGuid != Guid.Empty)
{

}

return MyUserName;
}


Think I need to add the Monox User Api User adepter but cant seem to get it to work..
Any way you guys can please help me out..

Thanks,

Hi Mzilic,

Is this secure ?

HttpContext.Current.User.Identity.Name ?

Like I would assume the security gui part ?

Because I am saving information into my file structure..

For all my own parts i mainly used guid, but for this part I want it to save into the users profile location.
ROOT\Upload\user\X

This code is to be used to fill in X..

I just took your ides and wrapped it around my MonoX security to secure it..

Take a look,

do I need to use this method or is there maybe a better way .. ?

public string GetMyUserName()
{
Guid MyGuid = Guid.Empty;
string MyUserName = string.Empty;

MyGuid = SecurityUtility.GetUserId();

if (MyGuid != Guid.Empty)
{

//check to see if logged in gui matches indenity of given user identity string.
Guid DbGuid = SecurityUtility.GetUserId(HttpContext.Current.User.Identity.Name);

if ((DbGuid == MyGuid) & (DbGuid != Guid.Empty))
{
MyUserName = HttpContext.Current.User.Identity.Name;
}
else
{
MyUserName = string.Empty;
}

}

return MyUserName;

Hello,

Using the code which I mentioned is secure, it is also used internally by SecurityUtility.

Regards

So If i change my function too.


public string GetMyUserName()

{
MyUserName = HttpContext.Current.User.Identity.Name;
}

then this is just as secure as the function above ?
I am just worried about the whole HttpContext deal here..

Like is this information available in a cookie or somewhere else that it can be easily edited via firefox plugin or hard code..
Is there any way for a user to open this object and modify the client side string ?

HttpContext scares the hell out of me as web programmer..
Maybe its just the name...

I would be interested to know more about how this function actually works before removing the code i wrote before that I think is more secure but more work on the system.

Hi Shawn,
you don't have to avoid using it - it is secure as it can be in the context of Web programming. The client-side thing you are referring to is actually the authentication cookie - a container for the forms authenticatiion ticket: http://support.microsoft.com/kb/910443 HttpContext is a server-side mechanism that appears frequently in most ASP.NET apps - for more details, check http://stackoverflow.com/questions/787143/where-does-web-httpcontext-current-user-identity-name-come-from