[3.0.x] Refs #28699 -- Clarified CSRF middleware ordering in relation to RemoteUserMiddleware.

Backport of 94469504706b494877b6bb45a979bcb81c7fd7be from master

1 files changed, 4 insertions, 0 deletions

diff --git a/docs/ref/middleware.txt b/docs/ref/middleware.txt
index 04b598625e..d9f544737d 100644
--- a/docs/ref/middleware.txt
+++ b/docs/ref/middleware.txt
@@ -557,6 +557,10 @@ Here are some hints about the ordering of various Django middleware classes:
    Before any view middleware that assumes that CSRF attacks have been dealt
    with.
 
+   Before :class:`~django.contrib.auth.middleware.RemoteUserMiddleware`, or any
+   other authentication middleware that may perform a login, and hence rotate
+   the CSRF token, before calling down the middleware chain.
+
    After ``SessionMiddleware`` if you're using :setting:`CSRF_USE_SESSIONS`.
 
 #. :class:`~django.contrib.auth.middleware.AuthenticationMiddleware`