[Django] #36862: Clarify RemoteUserMiddleware usage and deployment requirements under ASGI

[Django]

#36862: Clarify RemoteUserMiddleware usage and deployment requirements under ASGI
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Type:
| Cleanup/optimization
Status: new | Component:
| Documentation
Version: 6.0 | Severity: Normal
Keywords: | Triage Stage:
RemoteUserMiddleware asgi | Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
The current `RemoteUser` [https://docs.djangoproject.com/en/6.0/howto
/auth-remote-user/ docs] explains the trust model assuming a front-end web
server that **securely** sets `REMOTE_USER` env var, but it does not
clearly address ASGI deployments where Django may be the direct HTTP
endpoint ( uvicorn, daphne examples). This can lead readers to assume that
enabling `RemoteUserMiddleware` under ASGI without a reverse proxy is
safe.

The docs should explicitly state that `RemoteUserMiddleware` assumes a
trusted upstream that sets or strips the relevant header, and that running
ASGI servers directly on the Internet without such a proxy will allow
clients to inject identity headers. This is a documentation clarification
only and does not change behavior.
--
Ticket URL: <https://code.djangoproject.com/ticket/36862>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

[Django]

#36862: Clarify RemoteUserMiddleware usage and deployment requirements under ASGI
-------------------------------------+-------------------------------------

Reporter: Natalia Bidart | Owner: (none)
Type: | Status: new
Cleanup/optimization |
Component: Documentation | Version: 6.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
RemoteUserMiddleware asgi |

Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Jacob Walls):

* stage: Unreviewed => Accepted

--
Ticket URL: <https://code.djangoproject.com/ticket/36862#comment:1>

[Django]

#36862: Clarify RemoteUserMiddleware usage and deployment requirements under ASGI
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Owner: (none)
Type: | Status: new
Cleanup/optimization |
Component: Documentation | Version: 6.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
RemoteUserMiddleware asgi |
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Comment (by Kundan Yadav):

can i work on this issue ?
--
Ticket URL: <https://code.djangoproject.com/ticket/36862#comment:2>

[Django]

#36862: Clarify RemoteUserMiddleware usage and deployment requirements under ASGI
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Owner: (none)
Type: | Status: new
Cleanup/optimization |
Component: Documentation | Version: 6.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
RemoteUserMiddleware asgi |
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Comment (by Natalia Bidart):

Replying to [comment:2 Kundan Yadav]:

> can i work on this issue ?

You are welcome to work on this ticket. That said, please note that this
is not a straightforward issue and requires strong familiarity with ASGI
and the `REMOTE_USER` authentication mechanism.

Also, please avoid relying on LLMs to drive your contribution, and ensure
that you have carefully read the contributing documentation we have
shared. In recent submissions, we have noticed that the code and
documentation style do not fully align with the guidelines outlined in the
Django [https://docs.djangoproject.com/en/6.0/internals/contributing
/writing-code/coding-style/ coding style documentation]. While some checks
are automated, others are not. We therefore expect contributors to
manually review their work and ensure it follows the documented
conventions before submitting it for review.
--
Ticket URL: <https://code.djangoproject.com/ticket/36862#comment:3>

[Django]

#36862: Clarify RemoteUserMiddleware usage and deployment requirements under ASGI
-------------------------------------+-------------------------------------

Reporter: Natalia Bidart | Owner: Kundan
Type: | Yadav
Cleanup/optimization | Status: assigned

Component: Documentation | Version: 6.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
RemoteUserMiddleware asgi |
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Kundan Yadav):

* owner: (none) => Kundan Yadav
* status: new => assigned

--
Ticket URL: <https://code.djangoproject.com/ticket/36862#comment:4>

[Django]

#36862: Clarify RemoteUserMiddleware usage and deployment requirements under ASGI
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Owner: Kundan
Type: | Yadav
Cleanup/optimization | Status: assigned
Component: Documentation | Version: 6.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
RemoteUserMiddleware asgi |

Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Changes (by Kundan Yadav):

* has_patch: 0 => 1

Comment:

https://github.com/django/django/pull/20562
--
Ticket URL: <https://code.djangoproject.com/ticket/36862#comment:5>

[Django]

#36862: Clarify RemoteUserMiddleware usage and deployment requirements under ASGI
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Owner: Kundan
Type: | Yadav
Cleanup/optimization | Status: assigned
Component: Documentation | Version: 6.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
RemoteUserMiddleware asgi |

Has patch: 0 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Jacob Walls):

* cc: Andrew Godwin, Carlton Gibson, Jake Howard (removed)
* has_patch: 1 => 0

--
Ticket URL: <https://code.djangoproject.com/ticket/36862#comment:6>

[Django]

#36862: Clarify RemoteUserMiddleware usage and deployment requirements under ASGI
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Owner: Kundan
Type: | Yadav
Cleanup/optimization | Status: assigned
Component: Documentation | Version: 6.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
RemoteUserMiddleware asgi |
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Comment (by VIZZARD-X):

Hi, I’d like to take this up, since the owner of the ticket has not
produced a patch yet and there have been no formal updates regarding the
ticket.
--
Ticket URL: <https://code.djangoproject.com/ticket/36862#comment:7>

[Django]

#36862: Clarify RemoteUserMiddleware usage and deployment requirements under ASGI
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Owner: Kundan
Type: | Yadav
Cleanup/optimization | Status: assigned
Component: Documentation | Version: 6.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
RemoteUserMiddleware asgi |
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Comment (by Jacob Walls):

Vizzard, the experience from #36750 hasn't given me the confidence that
you can handle multiple tickets at a time, so I'd prefer that you wait
until we bring that one to completion.
--
Ticket URL: <https://code.djangoproject.com/ticket/36862#comment:8>

[Django]

#36862: Clarify RemoteUserMiddleware usage and deployment requirements under ASGI
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Owner: Kundan
Type: | Yadav
Cleanup/optimization | Status: assigned
Component: Documentation | Version: 6.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
RemoteUserMiddleware asgi |
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Comment (by VIZZARD-X):

Hello Jacob, since #36750 is completed, can I take this ticket up with
your permission?
--
Ticket URL: <https://code.djangoproject.com/ticket/36862#comment:9>

[Django]

#36862: Clarify RemoteUserMiddleware usage and deployment requirements under ASGI
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Owner: Kundan
Type: | Yadav
Cleanup/optimization | Status: assigned
Component: Documentation | Version: 6.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
RemoteUserMiddleware asgi |
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by VIZZARD-X):

* cc: VIZZARD-X (added)

--
Ticket URL: <https://code.djangoproject.com/ticket/36862#comment:10>

[Django]

#36862: Clarify RemoteUserMiddleware usage and deployment requirements under ASGI
-------------------------------------+-------------------------------------

Reporter: Natalia Bidart | Owner: Jacob
Type: | Walls

Cleanup/optimization | Status: assigned
Component: Documentation | Version: 6.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
RemoteUserMiddleware asgi |
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Jacob Walls):

* owner: Kundan Yadav => Jacob Walls

Comment:

Now that I close more duplicate reports about this more often than I
consume hot meals, if you don't mind Vizzard, I'll going to assign to
myself to put it on a critical path.
--
Ticket URL: <https://code.djangoproject.com/ticket/36862#comment:11>

[Django]

#36862: Clarify RemoteUserMiddleware usage and deployment requirements under ASGI
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Owner: Jacob
Type: | Walls
Cleanup/optimization | Status: assigned
Component: Documentation | Version: 6.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
RemoteUserMiddleware asgi |
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Comment (by Jacob Walls):

Note to self: also update security reporting guidelines.
--
Ticket URL: <https://code.djangoproject.com/ticket/36862#comment:12>

[Django]

#36862: Clarify RemoteUserMiddleware usage and deployment requirements under ASGI
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Owner: Jacob
Type: | Walls
Cleanup/optimization | Status: assigned
Component: Documentation | Version: 6.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
RemoteUserMiddleware asgi |

Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Jacob Walls):

* cc: VIZZARD-X (removed)

* has_patch: 0 => 1

Comment:

[https://github.com/django/django/pull/21043 PR]
--
Ticket URL: <https://code.djangoproject.com/ticket/36862#comment:13>

[Django]

#36862: Clarify RemoteUserMiddleware usage and deployment requirements under ASGI
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Owner: Jacob
Type: | Walls
Cleanup/optimization | Status: assigned
Component: Documentation | Version: 6.0
Severity: Normal | Resolution:

Keywords: | Triage Stage: Ready for
RemoteUserMiddleware asgi | checkin

Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Clifford Gama):

* stage: Accepted => Ready for checkin

--
Ticket URL: <https://code.djangoproject.com/ticket/36862#comment:14>

[Django]

#36862: Clarify RemoteUserMiddleware usage and deployment requirements under ASGI
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Owner: Jacob
Type: | Walls

Cleanup/optimization | Status: closed
Component: Documentation | Version: 6.0
Severity: Normal | Resolution: fixed

Keywords: | Triage Stage: Ready for
RemoteUserMiddleware asgi | checkin
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Jacob Walls <jacobtylerwalls@…>):

* resolution: => fixed
* status: assigned => closed

Comment:

In [changeset:"2ee757ee502d5663f932dc5c35175c39af4640ce" 2ee757ee]:
{{{#!CommitTicketReference repository=""
revision="2ee757ee502d5663f932dc5c35175c39af4640ce"
Fixed #36862 -- Doc'd the need for a proxy when deploying
RemoteUserMiddleware under ASGI.

We have a flood of nuisance security reports describing ASGI deployments
using RemoteUserMiddleware without a fronting proxy, which is not
realistic.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/36862#comment:15>

[Django]

#36862: Clarify RemoteUserMiddleware usage and deployment requirements under ASGI
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Owner: Jacob
Type: | Walls
Cleanup/optimization | Status: closed
Component: Documentation | Version: 6.0
Severity: Normal | Resolution: fixed
Keywords: | Triage Stage: Ready for
RemoteUserMiddleware asgi | checkin
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Comment (by Jacob Walls <jacobtylerwalls@…>):

In [changeset:"64dfc41d563afe3c66402f7906c902800d0a3ac6" 64dfc41]:
{{{#!CommitTicketReference repository=""
revision="64dfc41d563afe3c66402f7906c902800d0a3ac6"
[6.0.x] Fixed #36862 -- Doc'd the need for a proxy when deploying

RemoteUserMiddleware under ASGI.

We have a flood of nuisance security reports describing ASGI deployments
using RemoteUserMiddleware without a fronting proxy, which is not
realistic.

Backport of 2ee757ee502d5663f932dc5c35175c39af4640ce from main.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/36862#comment:16>

[Django]

#36862: Clarify RemoteUserMiddleware usage and deployment requirements under ASGI
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Owner: Jacob
Type: | Walls
Cleanup/optimization | Status: closed
Component: Documentation | Version: 6.0
Severity: Normal | Resolution: fixed
Keywords: | Triage Stage: Ready for
RemoteUserMiddleware asgi | checkin
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Jacob Walls <jacobtylerwalls@…>):

In [changeset:"04bcc9913319e50b376a27c29cf9aa4e7b8247bf" 04bcc991]:
{{{#!CommitTicketReference repository=""
revision="04bcc9913319e50b376a27c29cf9aa4e7b8247bf"
Refs #36862 -- Reiterated security note on both variants of
RemoteUserMiddleware.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/36862#comment:17>

[Django]

#36862: Clarify RemoteUserMiddleware usage and deployment requirements under ASGI
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Owner: Jacob
Type: | Walls
Cleanup/optimization | Status: closed
Component: Documentation | Version: 6.0
Severity: Normal | Resolution: fixed
Keywords: | Triage Stage: Ready for
RemoteUserMiddleware asgi | checkin
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Jacob Walls <jacobtylerwalls@…>):

In [changeset:"640c431a47c4075538e1de0211501f911346b65e" 640c431]:
{{{#!CommitTicketReference repository=""
revision="640c431a47c4075538e1de0211501f911346b65e"
[6.0.x] Refs #36862 -- Reiterated security note on both variants of
RemoteUserMiddleware.

Backport of 04bcc9913319e50b376a27c29cf9aa4e7b8247bf from main.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/36862#comment:18>

[Django]

#36862: Clarify RemoteUserMiddleware usage and deployment requirements under ASGI
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Owner: Jacob
Type: | Walls
Cleanup/optimization | Status: closed
Component: Documentation | Version: 6.0
Severity: Normal | Resolution: fixed
Keywords: | Triage Stage: Ready for
RemoteUserMiddleware asgi | checkin
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Jacob Walls <jacobtylerwalls@…>):

In [changeset:"90afa9b0f4782d2344b01dab92e8aa0227ce8fe8" 90afa9b0]:
{{{#!CommitTicketReference repository=""
revision="90afa9b0f4782d2344b01dab92e8aa0227ce8fe8"
Refs #36862 -- Clarified security note for RemoteUserMiddleware.

Co-authored-by: Sarah Boyce <42296566+...@users.noreply.github.com>
Co-authored-by: Jake Howard <g...@theorangeone.net>
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/36862#comment:19>

[Django]

#36862: Clarify RemoteUserMiddleware usage and deployment requirements under ASGI
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Owner: Jacob
Type: | Walls
Cleanup/optimization | Status: closed
Component: Documentation | Version: 6.0
Severity: Normal | Resolution: fixed
Keywords: | Triage Stage: Ready for
RemoteUserMiddleware asgi | checkin
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Jacob Walls <jacobtylerwalls@…>):

In [changeset:"538066963bbb87a8305a7216046c7d74b2a5fc22" 5380669]:
{{{#!CommitTicketReference repository=""
revision="538066963bbb87a8305a7216046c7d74b2a5fc22"
[6.0.x] Refs #36862 -- Clarified security note for RemoteUserMiddleware.

Co-authored-by: Sarah Boyce <42296566+...@users.noreply.github.com>
Co-authored-by: Jake Howard <g...@theorangeone.net>

Backport of 90afa9b0f4782d2344b01dab92e8aa0227ce8fe8 from main.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/36862#comment:20>