title: difference between http.context.user and thread.currentprincipal and when to use them?
body: <p>I have just recently run into an issue running an asp.net web app under visual studio 2008.  I get the error 'type is not resolved for member...customUserPrincipal'.  Tracking down various discussion groups it seems that there is an issue with Visual Studio's web server when you assign a custom principal against the Thread.CurrentPrincipal.</p>
  
  <p>In my code, I now use...</p>
  
  <pre><code>HttpContext.Current.User = myCustomPrincipal
  //Thread.CurrentPrincipal = myCustomPrincipal
  </code></pre>
  
  <p>I'm glad that I got the error out of the way, but it begs the question "What is the difference between these two methods of setting a principal?".  There are other stackoverflow <a href="https://stackoverflow.com/questions/1843271/whats-the-difference-between-httpcontext-current-user-and-thread-currentprincipa">questions</a> related to the differences but they don't get into the details of the two approaches.</p>
  
  <p>I did find one tantalizing post that had the following grandiose comment but no explanation to back up his assertions...</p>
  
  <blockquote>
    <p>Use HttpConext.Current.User for all
    web (ASPX/ASMX) applications.</p>
    
    <p>Use Thread.CurrentPrincipal for all
    other applications like winForms,
    console and windows service
    applications.</p>
  </blockquote>
  
  <p>Can any of you security/dot.net gurus shed some light on this subject?</p>