Passing django user as redirect request header












0















I have a (non-django) application A that requires a username to login. This app allows for pre authorization, which I want to provide from my django application B. However app A requires that the username is set as a remote_user request header. What I tried to do is create a view in django app B that redirects to app A passing a remote_user header.



urls.py



url(r'^{0}to_app_a$'.format(DJANGO_BASE), 'app.views.to_app_a')


views.py



def to_app_a(request):
response = redirect('http://app_a')
response['remote_user] = request.user

return response


The problem with that is that the header is lost on redirect and never reaches the request to http://app_a external app. It has been suggested to use cookies instead, but unfortunately app A won't accept anything else than a remote_user request header.



Has anyone come up with a solution to such issue?



Thank you










share|improve this question























  • There's no way to tell the user-agent what headers to use when redirecting. The only alternative is to implement your own redirection functionality in Javascript and skip HTTP redirects entirely.

    – Kevin Christopher Henry
    Nov 23 '18 at 9:50











  • I see... Javascript is an option but on a second thought, is this approach vulnerable to spoofing?

    – unicorn
    Nov 23 '18 at 10:02











  • If you're using the header for authentication (as opposed to pre-filling a username field), and the value is guessable (such as a username), then definitely! If the value is not guessable, then you're basically re-creating token authentication.

    – Kevin Christopher Henry
    Nov 23 '18 at 10:08
















0















I have a (non-django) application A that requires a username to login. This app allows for pre authorization, which I want to provide from my django application B. However app A requires that the username is set as a remote_user request header. What I tried to do is create a view in django app B that redirects to app A passing a remote_user header.



urls.py



url(r'^{0}to_app_a$'.format(DJANGO_BASE), 'app.views.to_app_a')


views.py



def to_app_a(request):
response = redirect('http://app_a')
response['remote_user] = request.user

return response


The problem with that is that the header is lost on redirect and never reaches the request to http://app_a external app. It has been suggested to use cookies instead, but unfortunately app A won't accept anything else than a remote_user request header.



Has anyone come up with a solution to such issue?



Thank you










share|improve this question























  • There's no way to tell the user-agent what headers to use when redirecting. The only alternative is to implement your own redirection functionality in Javascript and skip HTTP redirects entirely.

    – Kevin Christopher Henry
    Nov 23 '18 at 9:50











  • I see... Javascript is an option but on a second thought, is this approach vulnerable to spoofing?

    – unicorn
    Nov 23 '18 at 10:02











  • If you're using the header for authentication (as opposed to pre-filling a username field), and the value is guessable (such as a username), then definitely! If the value is not guessable, then you're basically re-creating token authentication.

    – Kevin Christopher Henry
    Nov 23 '18 at 10:08














0












0








0








I have a (non-django) application A that requires a username to login. This app allows for pre authorization, which I want to provide from my django application B. However app A requires that the username is set as a remote_user request header. What I tried to do is create a view in django app B that redirects to app A passing a remote_user header.



urls.py



url(r'^{0}to_app_a$'.format(DJANGO_BASE), 'app.views.to_app_a')


views.py



def to_app_a(request):
response = redirect('http://app_a')
response['remote_user] = request.user

return response


The problem with that is that the header is lost on redirect and never reaches the request to http://app_a external app. It has been suggested to use cookies instead, but unfortunately app A won't accept anything else than a remote_user request header.



Has anyone come up with a solution to such issue?



Thank you










share|improve this question














I have a (non-django) application A that requires a username to login. This app allows for pre authorization, which I want to provide from my django application B. However app A requires that the username is set as a remote_user request header. What I tried to do is create a view in django app B that redirects to app A passing a remote_user header.



urls.py



url(r'^{0}to_app_a$'.format(DJANGO_BASE), 'app.views.to_app_a')


views.py



def to_app_a(request):
response = redirect('http://app_a')
response['remote_user] = request.user

return response


The problem with that is that the header is lost on redirect and never reaches the request to http://app_a external app. It has been suggested to use cookies instead, but unfortunately app A won't accept anything else than a remote_user request header.



Has anyone come up with a solution to such issue?



Thank you







django redirect request http-headers






share|improve this question













share|improve this question











share|improve this question




share|improve this question










asked Nov 23 '18 at 6:42









unicornunicorn

797




797













  • There's no way to tell the user-agent what headers to use when redirecting. The only alternative is to implement your own redirection functionality in Javascript and skip HTTP redirects entirely.

    – Kevin Christopher Henry
    Nov 23 '18 at 9:50











  • I see... Javascript is an option but on a second thought, is this approach vulnerable to spoofing?

    – unicorn
    Nov 23 '18 at 10:02











  • If you're using the header for authentication (as opposed to pre-filling a username field), and the value is guessable (such as a username), then definitely! If the value is not guessable, then you're basically re-creating token authentication.

    – Kevin Christopher Henry
    Nov 23 '18 at 10:08



















  • There's no way to tell the user-agent what headers to use when redirecting. The only alternative is to implement your own redirection functionality in Javascript and skip HTTP redirects entirely.

    – Kevin Christopher Henry
    Nov 23 '18 at 9:50











  • I see... Javascript is an option but on a second thought, is this approach vulnerable to spoofing?

    – unicorn
    Nov 23 '18 at 10:02











  • If you're using the header for authentication (as opposed to pre-filling a username field), and the value is guessable (such as a username), then definitely! If the value is not guessable, then you're basically re-creating token authentication.

    – Kevin Christopher Henry
    Nov 23 '18 at 10:08

















There's no way to tell the user-agent what headers to use when redirecting. The only alternative is to implement your own redirection functionality in Javascript and skip HTTP redirects entirely.

– Kevin Christopher Henry
Nov 23 '18 at 9:50





There's no way to tell the user-agent what headers to use when redirecting. The only alternative is to implement your own redirection functionality in Javascript and skip HTTP redirects entirely.

– Kevin Christopher Henry
Nov 23 '18 at 9:50













I see... Javascript is an option but on a second thought, is this approach vulnerable to spoofing?

– unicorn
Nov 23 '18 at 10:02





I see... Javascript is an option but on a second thought, is this approach vulnerable to spoofing?

– unicorn
Nov 23 '18 at 10:02













If you're using the header for authentication (as opposed to pre-filling a username field), and the value is guessable (such as a username), then definitely! If the value is not guessable, then you're basically re-creating token authentication.

– Kevin Christopher Henry
Nov 23 '18 at 10:08





If you're using the header for authentication (as opposed to pre-filling a username field), and the value is guessable (such as a username), then definitely! If the value is not guessable, then you're basically re-creating token authentication.

– Kevin Christopher Henry
Nov 23 '18 at 10:08












0






active

oldest

votes











Your Answer






StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});














draft saved

draft discarded


















StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53441771%2fpassing-django-user-as-redirect-request-header%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown

























0






active

oldest

votes








0






active

oldest

votes









active

oldest

votes






active

oldest

votes
















draft saved

draft discarded




















































Thanks for contributing an answer to Stack Overflow!


  • Please be sure to answer the question. Provide details and share your research!

But avoid



  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.


To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53441771%2fpassing-django-user-as-redirect-request-header%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







這個網誌中的熱門文章

Xamarin.form Move up view when keyboard appear

Post-Redirect-Get with Spring WebFlux and Thymeleaf

Anylogic : not able to use stopDelay()