title: Is this Custom Principal in Base Controller ASP.NET MVC 3 terribly inefficient?
body: <p>Despite the fact that I've been on here for a while, this is my first ever question on SO, so please be gentle with me.</p>
  
  <p>I'm using <code>ASP.NET MVC 3</code> and I want to create a custom <code>Principal</code> so I can store a bit more info about the current user than is standard thus not have to go to the database too often.  It's fairly standard stuff that I'm after.  Let's just say email address and user id in the first instance.</p>
  
  <p>I have decided to store the object in the cache as I am aware that it is not advised to store it in the session.  </p>
  
  <p>I also don't want to have to keep casting the <code>User</code> object, so I wanted to override the <code>User</code> object in the controller.  So I can just go <code>User.UserId</code> and be guaranteed of something.</p>
  
  <p>So I created a custom principal like this:</p>
  
  <pre><code>public class MyPrincipal : IPrincipal
  {
      public MyPrincipal(IIdentity ident, List&lt;string&gt; roles, string email, Guid userId)
      {
          this._identity = ident;
          this._roles = roles;
          this._email = email;
          this._userId = userId;
      }
  
      IIdentity _identity;
  
      public IIdentity Identity
      {
          get { return _identity; }
      }
  
      private List&lt;string&gt; _roles;
  
      public bool IsInRole(string role)
      {
          return _roles.Contains(role);
      }
  
      private string _email;
  
      public string Email
      {
          get { return _email; }
      }
  
      private Guid _userId;
  
      public Guid UserId
      {
          get { return _userId; }
      }
  }
  </code></pre>
  
  <p>And I have a Base Controller like this:</p>
  
  <pre><code>public class BaseController : Controller
      {
          protected virtual new MyPrincipal User
          {
              get
              {
                  if (base.User is MyPrincipal)
                  {
                      return base.User as MyPrincipal;
                  }
                  else
                  {
                      return new MyPrincipal(base.User.Identity, new List&lt;string&gt;(0), "", Guid.Empty );
                  }
              }
          }
  
          protected override void OnAuthorization(AuthorizationContext filterContext)
          {
              if (User != null)
              {
                  if (User.Identity.IsAuthenticated)
                  {
                      if (User.Identity is FormsIdentity)
                      {
                          FormsIdentity id = base.User.Identity as FormsIdentity;
                          MyPrincipal principal = (MyPrincipal)filterContext.HttpContext.Cache.Get(id.Name);
                          if (principal == null)
                          {
                              MembershipUser user = Membership.GetUser();
  
                              // Create and populate your Principal object with the needed data and Roles.
                              principal = new MyPrincipal(id, Roles.GetRolesForUser(id.Name).ToList(), user.Email, (Guid)user.ProviderUserKey);
                              filterContext.HttpContext.Cache.Add(
                              id.Name,
                              principal,
                              null,
                              System.Web.Caching.Cache.NoAbsoluteExpiration,
                              new System.TimeSpan(0, 30, 0),
                              System.Web.Caching.CacheItemPriority.Default,
                              null);
                          }
                          filterContext.HttpContext.User = principal;
                          System.Threading.Thread.CurrentPrincipal = principal;
                          base.OnAuthorization(filterContext);
                      }
                  }
              }
          }
      }
  </code></pre>
  
  <p>If you have a look you will quickly realise that if the user has not logged in then <em>any</em> call to the <code>User</code> object will have to run through this bit of code:</p>
  
  <pre><code>return new MyPrincipal(base.User.Identity, new List&lt;string&gt;(0), "", Guid.Empty );
  </code></pre>
  
  <p>and this feels terribly inefficient to me, although it's only creating empty objects for the missing stuff.</p>
  
  <p>It works fine.</p>
  
  <p>So I guess I want to know if this is actually okay and I should stop being so anal about performance and efficiency, or if my fears are correct, in which case what should I be doing instead?  [Please don't say "Getting a life, mate!"]</p>