In general, ASP.NET propagates HttpContext.User to Thread.CurrentPrincipal so it should be safe to rely on the latter. Nonetheless, you raise a good point and I'll review the decision in the Error constructor. Perhaps HttpContext.User can override the value taken from Thread.CurrentPrincipal where an HttpContext was supplied.
- Atif