django.git/django/contrib/auth/init.py, branch main

Fixed #36901 -- Centralized auth timing attack mitigations.

2026-04-27T14:22:04Z

Thank you Mar Bartolome and Tim Schilling for reviews.

Fixed #37017 -- Fixed setting or clearing of request.user after alogin/alogout().

2026-04-02T13:00:55Z

Regression in 31a43c571f4d036827d4fd7a5f615591637dc1be.

Fixed #36903 -- Fixed further NameErrors when inspecting functions with deferred annotations.

2026-02-10T21:51:55Z

Provide a wrapper for safe introspection of user functions on Python 3.14+. Follow-up to 601914722956cc41f1f2c53972d669ddee6ffc04.

Refs #35530 -- Removed request.user or auser() fallback in auth.login and auth.alogin.

2025-09-17T18:17:05Z

Per deprecation timeline.

Fixed #36572 -- Revert "Fixed #36546 -- Deprecated django.utils.crypto.constant_time_compare() in favor of hmac.compare_digest()."

2025-08-27T08:50:50Z

This reverts commit 0246f478882c26bc1fe293224653074cd46a90d0.

Fixed #36546 -- Deprecated django.utils.crypto.constant_time_compare() in favor of hmac.compare_digest().

2025-08-25T12:45:16Z

Signed-off-by: SaJH

Refs #35530 -- Corrected deprecation message in auth.alogin().

2025-08-22T14:14:09Z

Follow up to ceecd518b19044181a3598c55ebed7c2545963cc.

Refs #35303 -- Made small optimizations in alogout() and aget_user().

2025-08-20T08:29:07Z

In alogout(), there is no need to check the is_authenticated attribute when user is None. In aget_user(), there is no need to call get_session_auth_hash() twice. Follow up to 50f89ae850f6b4e35819fe725a08c7e579bfd099.

Fixed #36561 -- Used request.auser() in contrib.auth.aupdate_session_auth_hash().

2025-08-20T07:14:50Z

Fixed #36540 -- Updated request.auser() in contrib.auth.alogin() and contrib.auth.alogout().

2025-08-08T07:51:03Z

django.git/django/contrib/auth/__init__.py, branch main