title: Best practice: User Identites as parameters?
body: <p>I am currently developing an API with ASP.NET in C#.</p>
  
  <p>One endpoint needs to call another in order to return a value.</p>
  
  <pre><code>public class Testcontroller : BaseApiController
  {
      [Authorize]
      [HttpGet]
      [Route("1", Name = "F1")]
      public async Task&lt;IHttpActionResult&gt; F1()
      {
          return await F2(); // calls 2nd method
      }
  
      [Authorize]
      [HttpGet]
      [Route("2", Name = "F2")]
      public async Task&lt;IHttpActionResult&gt; F2()
      {
          int I = 2;
          return Ok(I.ToString());
      }
  }
  </code></pre>
  
  <p>Ok, the returned value of this whole thing will be 2, which is absolutely fine. However, in the real API, the second methods needs to retrieve some data about the user. That is normally handled with</p>
  
  <pre><code>var Name = ClaimsPrincipal.Current.Identity.Name;
  var CurrentUser = await this.AppUserManager.FindByNameAsync(Name);
  </code></pre>
  
  <p>These two lines get the user information through the bearer token, that is passed to the method through the authorization process.</p>
  
  <p>Considering this, the first function could call the other one. The downside is that those two LOCs for the user data do not work because this token is not passed properly.</p>
  
  <p>How would you suggest working around this problem? I thought about adding an optional parameter and passing the CurrentUser through that. But I thought that might cause some issues in terms of security?</p>
  
  <p>Thanks for your help!</p>