id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
18265	request.user cached value does not track request.session change	Vlada Macek	nobody	"During the Single-Sign On technique implementation I came to the need of replacing request.session with a new session or just setting request.session = None.

The descriptor in AuthenticationMiddleware nevertheless does not remember the session for which it sets the request._cached_user.

IMHO, the descriptor should cache the session key when it saves the _cached_user and allow _cached_user to be used only when the session key did not unchange.

Currently everyone who changes the session during the request processing HAS to dig into the AuthenticationMiddleware internals and modify the _cached_user to get valid request.user. That's hard to maintain.

I can offer the patch, but would like to get some response first.
"	New feature	closed	contrib.auth	dev	Normal	wontfix		Melvyn Sopacua	Design decision needed	0	0	0	0	1	0