With RemoteUserMiddleware, users keep being logged in after web server stops sending REMOTE_USER headers

[Chris Lamb]

(Forwarded from ​http://bugs.debian.org/663230)

This was reproduced on 1.2.3-3+squeeze2 but the RemoteUserMiddleware code seems to be the same as the 1.3.1-4 in my development machine.

RemoteUserMiddleware relies on a REMOTE_USER variable to be set by the web server with the current user name, so far so good. However it does not log a person out if the variable disappears during the same browser session.

That may never happen with the usual browsers and auth, but it does happen for other setups like DACS that have a logout feature button.

The error is in this bit of django.contrib.auth.middleware.RemoteUserMiddleware:

        try:
            username = request.META[self.header]
        except KeyError:
            # If specified header doesn't exist then return (leaving
            # request.user set to AnonymousUser by the
            # AuthenticationMiddleware).
            return

The except side assumes that if there is no request.META[self.header],
then the user is the anonymous one.

Since I found that it is not always the case, I fixed it adding a simple
"auth.logout(request)" before returning:

        try:
            username = request.META[self.header]
        except KeyError:
            # If specified header doesn't exist then return (leaving
            # request.user set to AnonymousUser by the
            # AuthenticationMiddleware).

	    # Make sure that if the server did not send any headers,
	    # then we are actually logged out
            auth.logout(request)
            return

[Chris Lamb]

The fix which worked for Enrico is not perfect as calling auth.logout will flush the session, this would break sessions for logged-out users as they are cleared every request.

What we need to do instead is to check that we think the user "should" be logged in (SESSION_KEY in request.session?) and then make a call to logout.

[Enrico Zini]

@lamby: good point. I've now changed the site code to only log out if the user is authenticated:

              if request.user.is_authenticated():
                  auth.logout(request)

[Christopher Medrela]

I attached the file including enrico's solution, but I can't say if the solution works properly.

[bouchardsyl]

Added a test and documentation.
Please review, see pull request ​https://github.com/django/django/pull/134

[bouchardsyl]

PS : please ignore patch in Trac. Everything is in the pull request.

[Jannis Leidel]

Please don't close tickets if there hasn't been a commit yet. Accepting based on a discussion I had with the OP during DJangoCon and talk with Paul.

[bouchardsyl]

After 3 months, I just stumbled upon my un-pulled commits regarding this issue.
Time and commits have passed since, so I made a brand new pull request that works with today's fork of Django (Sept 9, 2012)
Please see ​https://github.com/django/django/pull/365

[Preston Holmes]

OK - I'm going to get this ready to commit - I'm adding a check to verify the backend used to authenticate the user.

The docs are vague about it - but I don't see any reason why ModelBackend and RemoteUserBackend can't be able to co-exist.

So I may add one more test that verifies that only users with the matching backend are logged out.

​https://github.com/ptone/django/compare/ticket/17869-remoteuser-auth

[Aymeric Augustin]

It would be better to use auth.BACKEND_SESSION_KEY, as in clean_username, than to redefine BACKEND_SESSION_KEY in this module.

Otherwise, this looks good to me.

[Preston Holmes <preston@…>]

In e8269a6729150d26a5497d5eb51226ca19fa21b9:

[1.5.x] Fixed #17869 - force logout when REMOTE_USER header disappears

If the current sessions user was logged in via a remote user backend log out
the user if REMOTE_USER header not available - otherwise leave it to other auth
middleware to install the AnonymousUser.

Thanks to Sylvain Bouchard for the initial patch and ticket maintenance.

[Preston Holmes <preston@…>]

In 9741912a9aaad083eaa8b9780cde37e1843cc4ae:

Fixed #17869 - force logout when REMOTE_USER header disappears

If the current sessions user was logged in via a remote user backend log out
the user if REMOTE_USER header not available - otherwise leave it to other auth
middleware to install the AnonymousUser.

Thanks to Sylvain Bouchard for the initial patch and ticket maintenance.