Question

I wonder if I can use User.Identity.Name to query data from my db.
Ex:

UsersBLL.GetPersonalInformation(string username)

Would passing the value of User.Identity.Name to this method is a good idea?
Can the value of User.Identity.Name be hijacked?

Answer 1

Could it be hijacked? Yes, for example via session hijacking due to insufficient transport layer protection (working example of this in that link) but this isn’t a risk with the membership provider implementation per se.

Rather than passing the user name around, I’d stick to the ID:

var user = Membership.GetUser();
var userId = (Guid?)user.ProviderUserKey;

I assume any tables dependent on the aspnet_Users user table (assuming, again, you’re using the default membership provider), are using the ID as the foreign key and not the username. At least I hope that’s the case!