Removing an authentication backend that's cached in a user's session causes exception

[Bradley Ayers <brad@…>]

Here's the scenario:

1. I add a new authentication backend to AUTHENTICATION_BACKENDS.
2. I deploy the code and a user logs in using that backend, and then logs out.
3. I decide I want to change the name of the backend, so I do, and update AUTHENTICATION_BACKENDS accordingly.
4. I deploy the code, and the same user loads the login page again.

On loading the page, an exception will be raised:

Traceback (most recent call last):

 File "/var/www/httpdocs/.env/lib/python2.7/site-packages/django/core/handlers/base.py", line 111, in get_response
 response = callback(request, *callback_args, **callback_kwargs)

 File "/var/www/httpdocs/.env/lib/python2.7/site-packages/console/base.py", line 105, in wrapped
 result = func(request, *args, **kwargs)

 File "/var/www/httpdocs/.env/lib/python2.7/site-packages/django/contrib/auth/decorators.py", line 19, in _wrapped_view
 if test_func(request.user):

 File "/var/www/httpdocs/.env/lib/python2.7/site-packages/django/utils/functional.py", line 184, in inner
 self._setup()

 File "/var/www/httpdocs/.env/lib/python2.7/site-packages/django/utils/functional.py", line 248, in _setup
 self._wrapped = self._setupfunc()

 File "/var/www/httpdocs/.env/lib/python2.7/site-packages/django/contrib/auth/middleware.py", line 16, in <lambda>
 request.user = SimpleLazyObject(lambda: get_user(request))

 File "/var/www/httpdocs/.env/lib/python2.7/site-packages/django/contrib/auth/middleware.py", line 8, in get_user
 request._cached_user = auth.get_user(request)

 File "/var/www/httpdocs/.env/lib/python2.7/site-packages/django/contrib/auth/__init__.py", line 100, in get_user
 backend = load_backend(backend_path)

 File "/var/www/httpdocs/.env/lib/python2.7/site-packages/django/contrib/auth/__init__.py", line 22, in load_backend
 raise ImproperlyConfigured('Module "%s" does not define a "%s" authentication backend' % (module, attr))

ImproperlyConfigured: Module "project.apps.core.backends" does not define a "EmailOrUsernameModelBackend" authentication backend

EmailOrUsernameModelBackend is the name of the old backend that has been renamed.

[Claude Paroz]

I guess that catching ImproperlyConfigured in addition to KeyError in get_user is the way to go here.

[Bradley Ayers <brad@…>]

I think the code that retrieves the auth backend from the session should ensure it's within AUTHENTICATION_BACKENDS. If it's not, treat it as invalid and ignore it.

[mhaligowski]

​https://github.com/django/django/pull/412

[Łukasz Rekucki]

The ticket isn't fixed until a core developer commits the code to the master. You should have just marked the "Has patch" flag. See ​https://docs.djangoproject.com/en/1.4/internals/contributing/triaging-tickets/#triage-stages for more info :)

[mhaligowski]

Ah, I expected so:) Sorry for that and thanks for the info.

[Preston Holmes]

We should probably remove the fixed on branch stage

[jorgebastida]

In the same way if a user logs in with backend A and then we remove A from AUTHENTICATION_BACKENDS the user will still be log in even if the backend is no longer available in AUTHENTICATION_BACKENDS but the module is.

Will write a patch and send a Pull Request.

[Claude Paroz <claude@…>]

In dc43fbc2f21c12e34e309d0e8a121020391aa03a:

Fixed #18998 - Prevented session crash when auth backend removed

Removing a backend configured in AUTHENTICATION_BACKENDS should not
raise an exception for existing sessions, but should make already
logged-in users disconnect.
Thanks Bradley Ayers for the report.