title: Completely custom authentication in ASP.NET MVC: losing HttpContext.User
body: <p>I have my very own authentication system (<a href="https://bitbucket.org/anton_gogolev/octalforty-structural">https://bitbucket.org/anton_gogolev/octalforty-structural</a>) which doesn't use any of the standard ASP.NET stuff (<code>&lt;authentication mode="None" /&gt;</code>). </p>
  
  <p>It uses plain <code>IHttpModule</code>s to do its job: <code>BeginRequest</code> inspects incoming cookies and sets <code>HttpContext.Current.User</code> and <code>Thread.CurrentPrincipal</code> upon successful authentication</p>
  
  <pre><code>Thread.CurrentPrincipal = HttpContext.Current.User = 
      new GenericPrincipal(tokenIdentity,new string[] { });
  </code></pre>
  
  <p>whereas <code>EndRequest</code> issues all the required cookies for an authenticated user.</p>
  
  <p>This has been working fine for months now, but on some systems (and I really cannot tell how are they different from ones this actually <em>works</em> on) ASP.NET seems to be losing the value of <code>HttpContext.Current.User</code>, replacing it with whatever default values there are (<code>GenericPrincipal</code> aggregating <code>GenericIdentity</code> with <code>IsAuthenticated</code> set to <code>false</code>, etc).</p>
  
  <p>So the question is: how and why is <code>HttpContext.Current.User</code> getting lost?</p>