Skip to content

[pull] main from django:main#401

Merged
pull[bot] merged 4 commits intothreatcode:mainfrom
django:main
May 6, 2026
Merged

[pull] main from django:main#401
pull[bot] merged 4 commits intothreatcode:mainfrom
django:main

Conversation

@pull
Copy link
Copy Markdown

@pull pull Bot commented May 6, 2026

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

jacobtylerwalls and others added 4 commits May 6, 2026 10:35
…er corresponds to request.META under ASGI.

Because these tests always passed both WSGI environ values and HTTP
headers via `**extra`, this masked a behavior difference between WSGI
and ASGI.

What should happen: everything should be passed via `headers` but for
the default REMOTE_USER case on WSGI, which should be passed via
`**extra`.

Since that was not done, a regression made it into Django 5.2
(50f89ae) where `.header` no longer
corresponded to the request.META key under ASGI. To cope, an ASGI user
would have started(*) sending HTTP headers that match the `.header`
attribute, which may or may not have been edited to remove the HTTP_
prefix. (Note: the default `REMOTE_USER` case did not work under ASGI,
so the change in Django 5.2 had the effect of fixing the default case
but changing the semantic of the custom case.)

(*): Unless they were getting the sync execution path, which didn't have
this bug. See the fix in 0f4fff7.

Thanks Mykhailo Havelia and Sarah Boyce for reviews.
Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
Co-authored-by: Jake Howard <git@theorangeone.net>
Since the existing user path eventually calls sync_to_async() in acheck_password,
aim for parity with the nonexistent/inactive user branch by adding sync_to_async().

Follow-up to 748ca0a.
@pull pull Bot locked and limited conversation to collaborators May 6, 2026
@pull pull Bot added the ⤵️ pull label May 6, 2026
@pull pull Bot merged commit 7f66c3b into threatcode:main May 6, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant