Code of Conduct
Feature Description
hello
in the process of filling request.user in the AuthenticationMiddleware, it calls auth.get_user
and that calls _get_user_session_key which is a hardcoded function in django, and as the name suggests, it only supports session base authentication
but django has authentication backends, which are plugable, and allow writers of auth libraries to plug-in their own logic, why would this part be excluded?
this limits django's auth system to only support session based authentication, and a lot of the toolings django provides don't work in other situations (such as tokens)
i propose moving this logic to backends, this way, auth libraries can come in and fill request.user, even if the user is authenticated using other methods, such as tokens and JWT.
Problem
if we look at API libraries in django ecosystem, they are all making their own auth system, that is not compatible with each other nor django,
and we have to maintain multiple versions of libraries that support tokens or JWT for each of them.
i would argue, since django already has an auth system, authentication should go through this system and libraries should be compatible.
(or atleast have the ability to be compatible)
Request or proposal
request
Additional Details
No response
Implementation Suggestions
No response
Code of Conduct
Feature Description
hello
in the process of filling request.user in the AuthenticationMiddleware, it calls
auth.get_userand that calls _get_user_session_key which is a hardcoded function in django, and as the name suggests, it only supports session base authentication
but django has authentication backends, which are plugable, and allow writers of auth libraries to plug-in their own logic, why would this part be excluded?
this limits django's auth system to only support session based authentication, and a lot of the toolings django provides don't work in other situations (such as tokens)
i propose moving this logic to backends, this way, auth libraries can come in and fill request.user, even if the user is authenticated using other methods, such as tokens and JWT.
Problem
if we look at API libraries in django ecosystem, they are all making their own auth system, that is not compatible with each other nor django,
and we have to maintain multiple versions of libraries that support tokens or JWT for each of them.
i would argue, since django already has an auth system, authentication should go through this system and libraries should be compatible.
(or atleast have the ability to be compatible)
Request or proposal
request
Additional Details
No response
Implementation Suggestions
No response