#28539: REMOTE_USER auth docs (and middleware logging?) should mention that
headers
with underscores are stripped when using "runserver" command
----------------------------------------+------------------------
Reporter: jcmcken | Owner: nobody
Type: New feature | Status: new
Component: contrib.auth | Version: 1.11
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 1
UI/UX: 0 |
----------------------------------------+------------------------
I seem to run into this slight annoyance every time I dive back into a new
Django app using REMOTE_USER auth:
When using the "runserver" command in a development capacity, and a custom
middleware that sets the header to "HTTP_REMOTE_USER", remote user auth
will fail because of what's mentioned here:
https://github.com/django/django/blob/ad524980ac9644d5d40c2c79af3c183f4351841e/docs/ref
/request-response.txt#L164
This should be mentioned or linked explicitly in the REMOTE_USER auth
docs. Even better, maybe there should be a security warning logged
whenever a header like this is removed, just to make it explicit when
examining the runserver STDOUT log.
What might also make this even more explicit is if there was an example in
the docs using something like the "curl" command to simulate logins.
--
Ticket URL: <https://code.djangoproject.com/ticket/28539>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/050.46f0be92d1fb19d112f4a7c31c32398e%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
