django/django — pull request #2936 by dgreisen-cfpb (2014-07-21 19:25:11+00:00)
Title: When RemoteUser authentication fails, logout any user

Currently, when `remoteUserBackend` fails to authenticate the
username passed in the header, and `create_unknown_user==False`,
`RemoteUserMiddleware` does nothing. Thus, if a different user
was logged in, that user will remain logged in despite the failed
attempt to log in a new user.

This is a security issue.

We fix this problem by logging out the request if the user returned
by the middleware is None (a failed login attempt).