How do I get an SPSite object from the SPWebEventProperties object passed into the SPWebEventReceiver.WebProvisioned method?

public override void WebProvisioned(SPWebEventProperties properties)
  • Never mind. It was silly. SPSite site = new SPSite(properties.SiteId); – Roxanne May 11 '11 at 18:36

There is no need to create a new SPSite object. Instead use:


This MSDN article Security Best Practices for Developers in SharePoint 2010 recommends against constructing SPSite objects using a Guid.

Construct SPSite Objects Safely

The Microsoft.SharePoint.SPSite constructor is prone to the following two problems:

New SPSite objects can be constructed by using a fully qualified domain name, for example http://contoso1.example.com. If this domain name is different from the current request context, it can lead to a cross-domain security issue.

New SPSite objects can be constructed by using a site identifier (ID) and optional user token, but without a fully qualified URL or Microsoft.SharePoint.Administration.SPUrlZone enumeration. If the current request context is not the Default zone, this can bypass web application policy.

It would be safer to use


as advised by Anders

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.