Fixed #37019 -- Updated login() and logout() to set request.auser.

2 files changed, 39 insertions, 28 deletions

diff --git a/django/contrib/auth/__init__.py b/django/contrib/auth/__init__.py
index d5d9acff88..723f348824 100644
--- a/django/contrib/auth/__init__.py
+++ b/django/contrib/auth/__init__.py
@@ -89,6 +89,22 @@ def _clean_credentials(credentials):
     return credentials
 
 
+def _set_auth_user(request, user=None):
+    from django.contrib.auth.models import AnonymousUser
+
+    if user is None:
+        user = AnonymousUser()
+
+    if hasattr(request, "user"):
+        request.user = user
+    if hasattr(request, "auser"):
+
+        async def auser():
+            return user
+
+        request.auser = auser
+
+
 def _get_user_session_key(request):
     # This value in the session is always serialized to a string, so we need
     # to convert it back to Python whenever we access it.
@@ -177,8 +193,7 @@ def login(request, user, backend=None):
     request.session[SESSION_KEY] = user._meta.pk.value_to_string(user)
     request.session[BACKEND_SESSION_KEY] = backend
     request.session[HASH_SESSION_KEY] = session_auth_hash
-    if hasattr(request, "user"):
-        request.user = user
+    _set_auth_user(request, user)
     rotate_token(request)
     user_logged_in.send(sender=user.__class__, request=request, user=user)
 
@@ -207,14 +222,7 @@ async def alogin(request, user, backend=None):
     await request.session.aset(SESSION_KEY, user._meta.pk.value_to_string(user))
     await request.session.aset(BACKEND_SESSION_KEY, backend)
     await request.session.aset(HASH_SESSION_KEY, session_auth_hash)
-    if hasattr(request, "user"):
-        request.user = user
-    if hasattr(request, "auser"):
-
-        async def auser():
-            return user
-
-        request.auser = auser
+    _set_auth_user(request, user)
     rotate_token(request)
     await user_logged_in.asend(sender=user.__class__, request=request, user=user)
 
@@ -231,10 +239,8 @@ def logout(request):
         user = None
     user_logged_out.send(sender=user.__class__, request=request, user=user)
     request.session.flush()
-    if hasattr(request, "user"):
-        from django.contrib.auth.models import AnonymousUser
 
-        request.user = AnonymousUser()
+    _set_auth_user(request)
 
 
 async def alogout(request):
@@ -249,20 +255,7 @@ async def alogout(request):
     await user_logged_out.asend(sender=user.__class__, request=request, user=user)
     await request.session.aflush()
 
-    has_user = hasattr(request, "user")
-    has_auser = hasattr(request, "auser")
-    if has_user or has_auser:
-        from django.contrib.auth.models import AnonymousUser
-
-        anon = AnonymousUser()
-        if has_user:
-            request.user = anon
-        if has_auser:
-
-            async def auser():
-                return anon
-
-            request.auser = auser
+    _set_auth_user(request)
 
 
 def get_user_model():
diff --git a/tests/auth_tests/test_middleware.py b/tests/auth_tests/test_middleware.py
index 894b49548b..a1c047abbd 100644
--- a/tests/auth_tests/test_middleware.py
+++ b/tests/auth_tests/test_middleware.py
@@ -1,5 +1,7 @@
+from asgiref.sync import sync_to_async
+
 from django.conf import settings
-from django.contrib.auth import REDIRECT_FIELD_NAME, alogin, alogout
+from django.contrib.auth import REDIRECT_FIELD_NAME, alogin, alogout, login, logout
 from django.contrib.auth.middleware import (
     AuthenticationMiddleware,
     LoginRequiredMiddleware,
@@ -68,6 +70,14 @@ class TestAuthenticationMiddleware(TestCase):
         auser_second = await self.request.auser()
         self.assertEqual(auser_second, self.user2)
 
+    async def test_auser_after_login(self):
+        self.middleware(self.request)
+        auser = await self.request.auser()
+        self.assertEqual(auser, self.user)
+        await sync_to_async(login)(self.request, self.user2)
+        auser_second = await self.request.auser()
+        self.assertEqual(auser_second, self.user2)
+
     async def test_auser_after_alogout(self):
         self.middleware(self.request)
         auser = await self.request.auser()
@@ -76,6 +86,14 @@ class TestAuthenticationMiddleware(TestCase):
         auser_second = await self.request.auser()
         self.assertTrue(auser_second.is_anonymous)
 
+    async def test_auser_after_logout(self):
+        self.middleware(self.request)
+        auser = await self.request.auser()
+        self.assertEqual(auser, self.user)
+        await sync_to_async(logout)(self.request)
+        auser_second = await self.request.auser()
+        self.assertTrue(auser_second.is_anonymous)
+
 
 class TestAsyncLoginLogoutAfterSyncMiddleware(TestCase):
     @classmethod