REMOTE_USER support

The CGI RFC provides for a REMOTE_USER variable, which holds the username of the user who has been authenticated by the front-end Web server. For a WSGI application, this can be obtained as environ["REMOTE_USER"], since a WSGI application gets access to all CGI variables. It would be nice if an ASGI application could get access to the same thing.

[andrewgodwin]

Yeah, my point about REMOTE_USER still mostly stands - it’s something that was tacked onto CGI because you can just pass arbitrary environment variables, and I’m not convinced it needs its own special ASGI key; I see very, very few applications that use REMOTE_USER these days as opposed to OAuth, SAML or similar, and even the proxies for those have to use headers, not CGI-style variables.

Given that, I’m not super sure we need it in there. SCRIPT_NAME is already tackled with prefix, since that is important enough to warrant one.

I’m not hardline on this - I just haven’t seen REMOTE_USER pop up in most open source things for a while. Do you have a set of use cases that it fits?

[andrewgodwin]

I agree this could happen in principle, but given that it’s very unlikely that ASGI would run under CGI (it would defeat the entire point), I’d rather not over-specify and include this for now, and instead suggest it’s passed on as a header instead if needed. This then matches with how authenticating reverse-proxies would have to do the same thing, and that’s a far more common scenario with modern Python deploys.