SPWeb.CurrentUser gives wrong result when called from HttpModule

Question

I am trying to get the current logged-in SharePoint username through SPWeb.CurrentUser. This usually provides the results I am expecting, except in one instance.

I am logged into my development machine using the dev_admin account, if this makes a difference. I have a custom HttpModule which processes all web requests in order to run some code when a user downloads a document. I switch to my test user and read out the value of SPContext.Current.Web.CurrentUser, getting the result sp_test as expected.

When the HttpModule runs, however, CurrentUser resolves to dev_admin.

    static void ContextPostAuthenticateRequest(object sender, EventArgs e)
    {
        var app = sender as HttpApplication;
        if (app != null)
        {
            string requesturl = app.Request.Url.ToString();

            // Inspect request url to see whether it's a request to download a document from the document library
            if (requesturl.StartsWith(Utils.reportsLibraryUrl) && (!requesturl.Contains(".aspx")) && (!requesturl.EndsWith("/")))
            {

                using (SPSite site = new SPSite(Utils.siteAddress))
                {
                    using (SPWeb web = site.OpenWeb())
                    {
                        String fileName = requesturl.Substring(Utils.reportsLibraryUrl.Length);

                        // This user has the wrong value, and is passed through web to another method
                        SPUser u = web.CurrentUser;

                        // Call event handler action to register downloaded document
                        web.AllowUnsafeUpdates = true;
                        EventHandlerActions.documentDownloaded(web, requesturl, fileName);
                        web.AllowUnsafeUpdates = false;
                    }
                }
            }
        }
    }

This seems related to this post. Am I misunderstanding something here? Does anyone know how to get a reference to the currently logged in user in this situation? For the record, HttpContext.Current.User.Identity.Name; gives the same result.

Answer 1

Firstly, no normal user can run the code in their identity to open any SPSite or SPWeb; The code is running under the application pool account and that's the reason that "web.CurrentUser" is always dev_admin .

Always use "SPContext.Current.Web.CurrentUser.LoginName".

Also, it's strange the "HttpContext.Current.User.Identity.Name" is also giving you the same identity, can you login as sp_test into the machine and open the url.

Check the Welcome control and see who has actually loggedin?? OR check the security setting and see if anomymous login is used in behalf of dev_admin.

I think the HTTP module can use SPContext.Current.Web rather that explicitly opening SPWEB

BTW I assume that the variable Utils.siteAddress is a readonly property reading from SPContext.Current.Site.URL