diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/internals/deprecation.txt | 4 | ||||
| -rw-r--r-- | docs/releases/1.8.txt | 15 | ||||
| -rw-r--r-- | docs/topics/auth/default.txt | 6 |
3 files changed, 25 insertions, 0 deletions
diff --git a/docs/internals/deprecation.txt b/docs/internals/deprecation.txt index 1db9e23d4e..15fbed1565 100644 --- a/docs/internals/deprecation.txt +++ b/docs/internals/deprecation.txt @@ -95,6 +95,10 @@ details on these changes. * ``django.shortcuts.render()`` * ``django.shortcuts.render_to_response()`` +* Session verification will be enabled regardless of whether or not + ``'django.contrib.auth.middleware.SessionAuthenticationMiddleware'`` is in + ``MIDDLEWARE_CLASSES``. + .. _deprecation-removed-in-1.9: 1.9 diff --git a/docs/releases/1.8.txt b/docs/releases/1.8.txt index 375a39920f..2ddcaf25bb 100644 --- a/docs/releases/1.8.txt +++ b/docs/releases/1.8.txt @@ -1158,6 +1158,21 @@ The default value of the :attr:`RedirectView.permanent <django.views.generic.base.RedirectView.permanent>` attribute will change from ``True`` to ``False`` in Django 1.9. +Using ``AuthenticationMiddleware`` without ``SessionAuthenticationMiddleware`` +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +:class:`django.contrib.auth.middleware.SessionAuthenticationMiddleware` was +added in Django 1.7. In Django 1.7.2, its functionality was moved to +``auth.get_user()`` and, for backwards compatibility, enabled only if +``'django.contrib.auth.middleware.SessionAuthenticationMiddleware'`` appears in +:setting:`MIDDLEWARE_CLASSES`. + +In Django 2.0, session verification will be enabled regardless of whether or not +``SessionAuthenticationMiddleware`` is enabled (at which point +``SessionAuthenticationMiddleware`` will have no significance). You can add it +to your ``MIDDLEWARE_CLASSES`` sometime before then to opt-in. Please read the +:ref:`upgrade considerations <session-invalidation-on-password-change>` first. + .. removed-features-1.8: Features removed in 1.8 diff --git a/docs/topics/auth/default.txt b/docs/topics/auth/default.txt index 8f19d12b48..62b070ee61 100644 --- a/docs/topics/auth/default.txt +++ b/docs/topics/auth/default.txt @@ -612,6 +612,12 @@ Session invalidation on password change is enabled in :setting:`MIDDLEWARE_CLASSES`. It's included if ``settings.py`` was generated by :djadmin:`startproject` on Django ≥ 1.7. + Session verification will become mandatory in Django 2.0 regardless of + whether or not ``SessionAuthenticationMiddleware`` is enabled. If you have + a pre-1.7 project or one generated using a template that doesn't include + ``SessionAuthenticationMiddleware``, consider enabling it before then after + reading the upgrade considerations below. + If your :setting:`AUTH_USER_MODEL` inherits from :class:`~django.contrib.auth.models.AbstractBaseUser` or implements its own :meth:`~django.contrib.auth.models.AbstractBaseUser.get_session_auth_hash()` |