title: In Django, is request.META[] the right place to add specific information for a request?
body: <p>I'm using Django, and want to store data that is relevant only for the duration of a request, and not on the session.</p>
  
  <p>Is it correct to add something to request.META, like:</p>
  
  <pre><code>request.META['acl'] = acl
  </code></pre>
  
  <p>In my situation, I am using Tastypie, with a custom authorization class, and need a way to pass data between functions... it seems like storing something on the request would be the right thing to do... I just don't know where to store such information.  My class looks something like:</p>
  
  <pre><code>class MyAuthorization(Authorization):
      def is_authorized(self, request, object=None):
          acl = getMyAccessControlList(request.method,request.session['username'])
          for permission in acl:
              if permission in self.permissions[request.method]:
                  request.META['acl'] = acl
                  return True
          return False
  
      def apply_limits(self, request, object_class, rs):
          if 'HAS_ALL_ACCESS' in request.META['acl']:
                  return rs
          else if 'HAS_USER_ACCESS' in request.META['acl']:
                  rs = rs.filter(object_class.user==request.session['username'])
                  return rs
  </code></pre>
  
  <p>Futher, Tastypie creates a single REST resource object, with a single authorization class used by all threads, so it's not thread-safe to just put it on the authorization class.</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>As per Chris Pratt's feedback, <strong>no</strong>, it doesn't make sense to modify the request.  Exploring further, it appears to be appropriate to modify the request initially through custom middleware, and then keep it constant for the rest of the request:  <a href="https://docs.djangoproject.com/en/1.4/topics/http/middleware" rel="nofollow">https://docs.djangoproject.com/en/1.4/topics/http/middleware</a></p>
  
  <p>In this case, the middleware will look something like:</p>
  
  <pre><code>class AccessControlListMiddleware(object):
      def process_view(self,request,view_func,view_args,view_kwargs):
          permissions = set()
          for role in request.session['permissions']:
              for permission in PERMISSION_LIST[request.method][role]:
                  permissions.add(permission)
          request.acl = list(permissions)
  </code></pre>