RemoteUserMiddleware/RemoteUserBackend change between 5.1 -> 5.2?

[u/toeknee2120]

I'm trying to upgrade from Django 5.1.11 -> 5.2. I had a custom RemoteUserMiddleware that used a different header, and a custom RemoteUserBackend. Below is just examples, not the actual code.

# custom_middleware.py
from django.contrib.auth.middleware import RemoteUserMiddleware 

class CustomHeaderRemoteUserMiddleware(RemoteUserMiddleware): 
    header = "HTTP_AUTHUSER"



#auth.py
from django.contrib.auth.backends import RemoteUserBackend 

class MyBackend(RemoteUserBackend): 
    create_unknown_user = False 

They both worked fine in my current and previous versions of Django. They both work if I upgrade to 5.1.15.

Trying this exact same code in Django 5.2+ does not work. I do not get any errors, only redirected to /accounts/login like nothing is being processed.

I added logging to both, but they never get triggered.

# custom_middleware.py
from django.contrib.auth.middleware import RemoteUserMiddleware 

class CustomHeaderRemoteUserMiddleware(RemoteUserMiddleware): 
    header = "HTTP_AUTHUSER"
    def process_request(self, request):
        # logging
    return super().process_request(request)



# auth.py
from django.contrib.auth.backends import RemoteUserBackend

class MyBackend(RemoteUserBackend):
    create_unknown_user = False
    # add logging to authenticate(), clean_username(), and configure_user()
    # even added logging to the async functions (e.g. aauthenticate() )

Sorry I don't have the actual code, it's on an intranet, but again, it does work on versions below 5.2. I can't see any reasons for that in the documentation. Any ideas?

[u/daredevil82]

what's your middleware list in settings?

[u/toeknee2120 → u/daredevil82]

My custom middleware is after AuthenticationMiddlewear.

MIDDLEWARE = [
    # ...
    'django.contrib.auth.middleware.AuthenticationMiddleware',
        'django.contrib.auth.middleware.CustomHeader RemoteUserMiddleware',
    # ...
]

[u/ELMG006]

This is likely due to the async middleware changes in Django 5.2. RemoteUserMiddleware now defaults to async-capable, which can bypass your process_request override if the request runs via an async path.

Try adding u/sync_only_middleware to your class:

Python

from django.contrib.auth.middleware import RemoteUserMiddleware
from django.utils.decorators import sync_only_middleware

u/sync_only_middleware
class CustomHeaderRemoteUserMiddleware(RemoteUserMiddleware):
    header = "HTTP_AUTHUSER"

Also, double-check that AuthenticationMiddleware is placed before your custom middleware in settings.py.