#25392: Auth without sessions
-------------------------------+--------------------
Reporter: rdaysky | Owner: nobody
Type: Uncategorized | Status: new
Component: contrib.auth | Version: 1.8
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------+--------------------
Currently, the authentication middleware requires the session middleware,
while in many cases, particularly when building an API-only backend,
sessions are completely unnecessary, and what’s worse, they cause a write
query during handling of otherwise read-only requests.
Instead, the authentication system should permit operation without
sessions altogether:
1. If sessions are unavailable, request.user should stay AnonymousUser
until user calls auth.login.
2. If sessions are unavailable, auth.login should be fine not saving
anything to sessions.
Additionally, in cases both a traditional Web interface and an API (where
authentication is handled by keys in HTTP headers or request parameters)
are present, it would be useful to be able to turn the session mechanism
on an off (or rather, to instruct the authentication mechanism not to
touch sessions) on per-request basis.
Additionally, when sessions are, in fact, made use of, they should not
perform write queries until something is actually saved into a session,
for performance reasons.
--
Ticket URL: <https://code.djangoproject.com/ticket/25392>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/050.d9ca4409652f8c1a8f6a267646726f0a%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
