login and logout should update request.user

[James Bennett]

Currently, django.contrib.auth.login and django.contrib.auth.logout don't update request.user, which means that things which happen after those functions are called (e.g., templates which include {% if user.is_authenticated %}) will not see that the authentication status has changed.

This causes some counterintuitive behavior:

• If you use django.contrib.auth.views.logout and have it return a template directly, the template may "think" you're still logged in even though you aren't (because request.user is still a User object). Having it return a redirect instead shows the expected behavior, because it ends up generating a new request).
• If you use forms which subclass django.contrib.auth.forms.AuthenticationForm (e.g., the form for posting registered comments), the form may still think you're anonymous even after it's successfully logged you in (because request.user is still an AnonymousUser object). This is why, for example, entering a username and password when previewing a registered comment seems to do nothing (the form will still think those fields are required, because it doesn't know you've successfully logged in during that request).

Having login and logout update request.user would clear this up.

[Chris Beaven]

Perhaps add a function to the LazyUser class in django.contrib.auth.middleware which clears request._cached_user (and shouldn't it really just store _cached_user in its own class rather than on request)?

[Chris Beaven]

Answering my own question: no it shouldn't because user is an object on the class, not on the request instance. My suggestion of adding a function to it still seems a valid solution.

[Vinay Sajip <vinay_sajip@…>]

Patch to update request.user in login and logout

[Gary Wilson <gary.wilson@…>]

Although, isn't it possible that one may be using the login/logout functions and not the AuthenticationMiddleware that is responsible for adding the user attribute to the request object?

[Vinay Sajip <vinay_sajip@…>]

Sorry, I don't understand. The patch is to the login/logout functions.

[Gary Wilson <gary.wilson@…>]

I must not have been thinking too clearly last night.

I was thinking that the patch would raise an error for those not using the AuthenticationMiddleware, since request.user wouldn't exist for them. But I guess since the patch is just assigning to request.user (and not accessing it beforehand) it wouldn't raise any errors. It would only slightly clutter the request object for someone not using AuthenticationMiddleware.

[Vinay Sajip <vinay_sajip@…>]

Well, AuthenticationMiddleware is tiny. If they're using authentication, it (or some other approach which sticks a User instance in the request) would be the path of least resistance...and if it's a fully public site, with no authentication, then login/logout wouldn't (I presume) get called.

[Malcolm Tredinnick]

(In [5472]) Fixed #4015 -- Changed login() and logout() messages to update request.user if
it is relevant. Thanks James Bennett, Vinay Sajip and Gary Wilson.