admin check for AuthenticationMiddleware should allow subclasses

[Alek Ratzloff]

I am attempting an upgrade from 2.1 to 2.2b1. I have a custom middleware in place for authentication which essentially wraps around the base AuthenticationMiddleware and sets/unsets a cookie upon login and logout. This was working with Django 2.1 as my authentication middleware.

Now, when I attempt to start my application, the check fails with admin.E408:

?: (admin.E408) 'django.contrib.auth.middleware.AuthenticationMiddleware' must be in MIDDLEWARE in order to use the admin application.

Is this a bug/regression, or have I been using the middleware incorrectly this whole time?

[Tim Graham]

The check is new in Django 2.2 (371ece2f0682e51f2f796854d3e091827a7cea63). It might be possible to modify it so that it detects AuthenticationMiddleware subclasses. You could also simply add that error to your SILENCED_SYSTEM_CHECKS setting.

[Simon Charette]

Agreed, import_string should be used to perform issubclass checks.

[Herman S]

I created a pull request with a possible solution to this issue. Reproduced the issue and tested that the patch worked for me: ​https://github.com/django/django/pull/11057

[Simon Charette]

Thanks for the PR. I left a few comments for improvements on the PR. Please uncheck patch needs improvement and needs tests once they are addressed.

[Tim Graham <timograham@…>]

In f976ab1b:

Fixed #30237 -- Made Authentication/SessionMiddleware and ModelBackend admin checks allow subclasses.

[Tim Graham <timograham@…>]

In d8704a4d:

[2.2.x] Fixed #30237 -- Made Authentication/SessionMiddleware and ModelBackend admin checks allow subclasses.

Backport of f976ab1b117574db78d884c94e549a6b8e4c9f9b from master.

[Tameron NGUYEN]

Replying to Tim Graham:

The check is new in Django 2.2 (371ece2f0682e51f2f796854d3e091827a7cea63). It might be possible to modify it so that it detects AuthenticationMiddleware subclasses. You could also simply add that error to your SILENCED_SYSTEM_CHECKS setting.

Errors: ?: (admin.E408) 'django.contrib.auth.middleware.AuthenticationMiddleware' must be in MIDDLEWARE in order to use the admin application.
In settings.py, add

SILENCED_SYSTEM_CHECKS = [
    'admin.E408',
]

[batistalucash]

I am not sure this issue was solved. Should something be changed in the settings.py file?

FYI: It started happening after a change the version of Django to the newest one.

[Mariusz Felisiak]

batistalucash, please don't reopen fixed tickets without providing any new information. This patch allows subclasses of AuthenticationMiddleware and SessionMiddleware.

[Niclas Olofsson]

Hmm, I just ran into this as well, but in our case we are using a subclass of SessionMiddleware. Looking at the patch I can see that SessionMiddleware is mentioned in the title, but I cannot see that the implementation actually checks for such subclasses?

[Mariusz Felisiak]

Niclas, see #30312.