Clarify RemoteUserMiddleware usage and deployment requirements under ASGI

[Natalia Bidart]

The current RemoteUser ​docs explains the trust model assuming a front-end web server that securely sets REMOTE_USER env var, but it does not clearly address ASGI deployments where Django may be the direct HTTP endpoint ( uvicorn, daphne examples). This can lead readers to assume that enabling RemoteUserMiddleware under ASGI without a reverse proxy is safe.

The docs should explicitly state that RemoteUserMiddleware assumes a trusted upstream that sets or strips the relevant header, and that running ASGI servers directly on the Internet without such a proxy will allow clients to inject identity headers. This is a documentation clarification only and does not change behavior.

[Kundan Yadav]

can i work on this issue ?

[Natalia Bidart]

Replying to Kundan Yadav:

can i work on this issue ?

You are welcome to work on this ticket. That said, please note that this is not a straightforward issue and requires strong familiarity with ASGI and the REMOTE_USER authentication mechanism.

Also, please avoid relying on LLMs to drive your contribution, and ensure that you have carefully read the contributing documentation we have shared. In recent submissions, we have noticed that the code and documentation style do not fully align with the guidelines outlined in the Django ​coding style documentation. While some checks are automated, others are not. We therefore expect contributors to manually review their work and ensure it follows the documented conventions before submitting it for review.

[Kundan Yadav]

​https://github.com/django/django/pull/20562

[VIZZARD-X]

Hi, I’d like to take this up, since the owner of the ticket has not produced a patch yet and there have been no formal updates regarding the ticket.

[Jacob Walls]

Vizzard, the experience from #36750 hasn't given me the confidence that you can handle multiple tickets at a time, so I'd prefer that you wait until we bring that one to completion.

[VIZZARD-X]

Hello Jacob, since #36750 is completed, can I take this ticket up with your permission?

[Jacob Walls]

Now that I close more duplicate reports about this more often than I consume hot meals, if you don't mind Vizzard, I'll going to assign to myself to put it on a critical path.

[Jacob Walls]

Note to self: also update security reporting guidelines.

[Jacob Walls]

​PR

[Jacob Walls <jacobtylerwalls@…>]

In 2ee757ee:

Fixed #36862 -- Doc'd the need for a proxy when deploying RemoteUserMiddleware under ASGI.

We have a flood of nuisance security reports describing ASGI deployments
using RemoteUserMiddleware without a fronting proxy, which is not
realistic.

[Jacob Walls <jacobtylerwalls@…>]

In 64dfc41:

[6.0.x] Fixed #36862 -- Doc'd the need for a proxy when deploying RemoteUserMiddleware under ASGI.

We have a flood of nuisance security reports describing ASGI deployments
using RemoteUserMiddleware without a fronting proxy, which is not
realistic.

Backport of 2ee757ee502d5663f932dc5c35175c39af4640ce from main.

[Jacob Walls <jacobtylerwalls@…>]

In 04bcc991:

Refs #36862 -- Reiterated security note on both variants of RemoteUserMiddleware.

[Jacob Walls <jacobtylerwalls@…>]

In 640c431:

[6.0.x] Refs #36862 -- Reiterated security note on both variants of RemoteUserMiddleware.

Backport of 04bcc9913319e50b376a27c29cf9aa4e7b8247bf from main.