title: Django remote user authentication and security
body: <p>I am using Django <a href="https://docs.djangoproject.com/en/dev/howto/auth-remote-user/" rel="noreferrer">remote user authentication</a> in a project. What I am actually using is just <code>django.contrib.auth.RemoteUserBackend</code> without the middleware, and manually calling <code>authenticate</code> after having checked with the backend that the user is legitimate.</p>
  
  <p>Reading the source of the middleware, it seems that it just takes the username from a header in the request and then authenticates the user against the backend passing this username. The remote user backend, in turn, just merrily logs the user in with whatever username was passed. The user has then access to every area that requires a valid login.</p>
  
  <blockquote>
    <p>Isn't this just a huge security flaw? How is this meant to be used?</p>
  </blockquote>
  
  <p>In my case I should be safe, since the only call to <code>authenticate</code> comes after a successful remote identity verification, but I am wondering the reason why the middleware was introduced.</p>