#23066: Already logged-in user remains logged in when RemoteUser authentication
of
new user fails
-------------------------------------+-------------------------------------
Reporter: david.greisen@… | Owner: nobody
Type: Bug | Status: new
Component: contrib.auth | Version: master
Severity: Normal | Resolution:
Keywords: remoteUserBackend | Triage Stage:
RemoteUserMiddleware | Unreviewed
Has patch: 1 | Needs documentation: 0
Needs tests: 1 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Changes (by timo):
* needs_docs: => 0
* has_patch: 0 => 1
* needs_tests: => 1
* easy: 1 => 0
* needs_better_patch: => 0
Comment:
If this is a security issue that can be exploited by an attacker, please
[https://docs.djangoproject.com/en/dev/internals/security/#reporting-
security-issues report the details privately]. If this is simply security
hardening, then it's fine to post more details here.
As far as I can tell, Django's normal authentication doesn't implement the
protocol of logging out an existing user after a failed login attempt.
Could you elaborate (to the security@ alias if necessary) on why
`RemoteUserMiddleware` needs to do so? Thanks.
(to be merged, the patch would also need a test)
--
Ticket URL: <https://code.djangoproject.com/ticket/23066#comment:1>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/080.f24b883427ee67d8e0bdb23f6d735b52%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
