Mention that RemoteUserMiddleware should be replaced when using custom header middleware with RemoteUserBackend

[Joonas Häkkinen]

REMOTE_USER authentication docs at ​https://docs.djangoproject.com/en/5.1/howto//auth-remote-user/ cover using a custom middleware to read the username from HTTP headers. However, it does not specify that the custom middleware should replace RemoteUserMiddleware rather than be appended to MIDDLEWARE.

This is essentially a small omission and might be clear to experienced Django users. However, at least for me, an experienced web developer but totally new to Django, this was surprising and the resulting CSRF validation failure made me suspect something completely different for two full days. Thus I though that a small mention about replacing instead of appending RemoteUserMiddleware with the custom one would be a reasonable addition to the docs.

I will be opening a PR for this shortly unless you think this is not worth including in the docs.

[Joonas Häkkinen]

Forgot to link the relevant discussion: ​https://forum.djangoproject.com/t/csrf-fails-when-remoteusermiddleware-is-used-behind-reverse-proxy-without-tls/38929/1

[Sarah Boyce]

Thank you for the ticket Joonas.
I am happy to review a PR with a small addition here, given this is a how-to doc and there aren't many examples of middleware being overridden in the docs

[Joonas Häkkinen]

​PR

[Sarah Boyce <42296566+sarahboyce@…>]

In 87c5de3b:

Fixed #36200 -- Clarified MIDDLEWARE setting updates when using a custom RemoteUserMiddleware.

[Sarah Boyce <42296566+sarahboyce@…>]

In aadc5c5:

[5.2.x] Fixed #36200 -- Clarified MIDDLEWARE setting updates when using a custom RemoteUserMiddleware.

Backport of 87c5de3b7f2316aa17353d74f54e6ff19013d049 from main.

[Sarah Boyce <42296566+sarahboyce@…>]

In 914cde19:

[5.1.x] Fixed #36200 -- Clarified MIDDLEWARE setting updates when using a custom RemoteUserMiddleware.

Backport of 87c5de3b7f2316aa17353d74f54e6ff19013d049 from main.