Andal.LND/edx-platform
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #18322 from edx/bmedx/remove_sessionauthenticationmiddleware

Browse Source 
Remove SessionAuthenticationMiddleware from INSTALLED_APPS
This commit is contained in:
Brian Mesick
2018-06-06 14:09:20 -04:00
committed by GitHub
parent 69341f806c 2ca632aec9
commit 3eb5e432e5
3 changed files with 2 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
cms/envs/common.py
View File

@@ -482,9 +482,6 @@ MIDDLEWARE_CLASSES = [
# Instead of AuthenticationMiddleware, we use a cache-backed version
'openedx.core.djangoapps.cache_toolbox.middleware.CacheBackedAuthenticationMiddleware',
# Enable SessionAuthenticationMiddleware in order to invalidate
# user sessions after a password change.
'django.contrib.auth.middleware.SessionAuthenticationMiddleware',
'student.middleware.UserStandingMiddleware',
'openedx.core.djangoapps.contentserver.middleware.StaticContentServer',

3
lms/envs/common.py
View File

@@ -1238,9 +1238,6 @@ MIDDLEWARE_CLASSES = [
# Instead of AuthenticationMiddleware, we use a cached backed version
#'django.contrib.auth.middleware.AuthenticationMiddleware',
'openedx.core.djangoapps.cache_toolbox.middleware.CacheBackedAuthenticationMiddleware',
# Enable SessionAuthenticationMiddleware in order to invalidate
# user sessions after a password change.
'django.contrib.auth.middleware.SessionAuthenticationMiddleware',
'student.middleware.UserStandingMiddleware',
'openedx.core.djangoapps.contentserver.middleware.StaticContentServer',

8
openedx/core/djangoapps/cache_toolbox/middleware.py
View File

@@ -120,19 +120,15 @@ class CacheBackedAuthenticationMiddleware(AuthenticationMiddleware):
def _verify_session_auth(self, request):
"""
Ensure that the user's session hash hasn't changed. We check that
SessionAuthenticationMiddleware is enabled in order to match Django's
behavior.
Ensure that the user's session hash hasn't changed.
"""
session_auth_class = 'django.contrib.auth.middleware.SessionAuthenticationMiddleware'
session_auth_enabled = session_auth_class in settings.MIDDLEWARE_CLASSES
# Auto-auth causes issues in Bok Choy tests because it resets
# the requesting user. Since session verification is a
# security feature, we can turn it off when auto-auth is
# enabled since auto-auth is highly insecure and only for
# tests.
auto_auth_enabled = settings.FEATURES.get('AUTOMATIC_AUTH_FOR_TESTING', False)
if not auto_auth_enabled and session_auth_enabled and hasattr(request.user, 'get_session_auth_hash'):
if not auto_auth_enabled and hasattr(request.user, 'get_session_auth_hash'):
session_hash = request.session.get(HASH_SESSION_KEY)
if not (session_hash and constant_time_compare(session_hash, request.user.get_session_auth_hash())):
# The session hash has changed due to a password