alogout does not clear the request.auser attribute

[Xdynix]

The request.auser method caches the user in _acached_user, which is not cleared during alogout. Therefore, the following view code will behave unexpectedly.

def delete_session(request: HttpRequest) -> None:
    logger.info("Current user:", user=request.user.username)  # user="user"
    logout(request)
    logger.info("Current user:", user=request.user.username)  # user=""
    return None

async def delete_session(request: HttpRequest) -> None:
    logger.info("Current user:", user=(await request.auser()).username)  # user="user"
    await alogout(request)
    logger.info("Current user:", user=(await request.auser()).username)  # user="user"
    return None

It should be able to be fixed by adding the following to alogout.

if hasattr(request, "_acached_user"):
    delattr(request, "_acached_user")

[Sarah Boyce]

I can't replicate. The behavior also matches the sync behavior

tests/async/test_async_auth.py

@@ -127 +127 @@
         await self.client.alogin(username="testuser", password="testpw")
         request = HttpRequest()
         request.session = await self.client.asession()
+        request.user = self.test_user
         await alogout(request)
+        self.assertNotEqual(request.user, self.test_user)
+        self.assertIsInstance(request.user, AnonymousUser)
         user = await aget_user(request)
         self.assertIsInstance(user, AnonymousUser)

[Xdynix]

The problematic code is within django/contrib/auth/middleware.py.

Add the following test case to auth_tests.test_middleware.TestAuthenticationMiddleware and you can reproduce it:

    async def test_auser_logout(self):
        from django.contrib.auth import alogout
        from django.contrib.auth.models import AnonymousUser
        self.middleware(self.request)
        auser = await self.request.auser()
        self.assertEqual(auser, self.user)
        await alogout(self.request)
        auser_second = await self.request.auser()
        self.assertIsInstance(auser_second, AnonymousUser)

[Sarah Boyce]

Thank you for the clarification and the test
Apologies, it makes sense we are refering to auser, rather than user, in the async case.
Confirmed that this bug has been present since alogout was implemented in 5e98959d9242c57a55c65847758781f82d386fa4 (5.0)

Here is a possible fix:

django/contrib/auth/__init__.py

@@ -269 +269 @@
         user = None
     await user_logged_out.asend(sender=user.__class__, request=request, user=user)
     await request.session.aflush()
-    if hasattr(request, "user"):
+    if hasattr(request, "auser"):
         from django.contrib.auth.models import AnonymousUser
+        async def auser():
+            return AnonymousUser()
 
-        request.user = AnonymousUser()
+        request.auser = auser
 
 
 def get_user_model():

Would you like to prepare a PR? This would include your test

[Xdynix]

Sure, I will submit a PR for it.

[Xdynix]

PR: ​https://github.com/django/django/pull/19709

[Sarah Boyce <42296566+sarahboyce@…>]

In 31a43c5:

Fixed #36540 -- Updated request.auser() in contrib.auth.alogin() and contrib.auth.alogout().