#23011: Getting user ID from a request shouldn't hit the database
---------------------------------+------------------------------------
Reporter: BertrandBordage | Owner: nobody
Type: New feature | Status: new
Component: contrib.auth | Version: master
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+------------------------------------
Comment (by carljm):
The inconsistency would still occur in the case where a user logs in, an
admin deletes their User from the database, and then they continue using
the same browser session, never having logged out. In this situation any
view depending on `request.user` would see an `AnonymousUser()`, even
though `request.userid` would still be set. It's perhaps a judgement call
whether the admin in this scenario should have a reasonable expectation
that deleting a User from the database would prevent any further access by
that user.
This is a variant of the same type of out-of-date-session concern that led
to introduction of `SessionAuthenticationMiddleware` in 1.7, which
invalidates pre-existing sessions when a user even just changes their
password. `SessionAuthenticationMiddleware` (which is now included in
`MIDDLEWARE_CLASSES` in the default startproject template) accesses
`request.user`, triggering the database query anyway. So nobody using a
default 1.7+ project would ever see any benefit from using a hypothetical
`request.user_id`. In my mind, that means it's a feature that's not worth
adding. It's possible to implement it yourself if you really want it, and
don't mind the odd inconsistency (and lack of user-existence verification)
that it introduces.
--
Ticket URL: <https://code.djangoproject.com/ticket/23011#comment:4>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/073.c7d60f932499c8b8ab66fdd961174a04%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
