I have custom server-side sessions (not JWT). User is given a token and on each API access a user object is retrieved from database using Entity Framework. Currently I'm trying to get use of built-in authentication mechanism to make code easier.

I implemented custom AuthenticationHandler where I get User object by token. Problem here is that almost all of the implementations I've seen are storing some user identifier (like username or id) in claims and then are retrieving it for DB lookup later.

This seems to me as an unnecessary loss of performance and clarity of code. Perfect solution would be to store already retrieved User object in HttpContext.User or something similar (but not things like HttpContext.Items["User"] where casting is necessary later).

Correct me if I'm wrong somewhere.

CodePudding user response：