Refs #23957 -- Required session verification per deprecation timeline.

import importlib

import os

import time

import warnings

from django.conf import global_settings

from django.core.exceptions import ImproperlyConfigured

from django.utils.deprecation import RemovedInDjango110Warning

from django.utils.functional import LazyObject, empty

ENVIRONMENT_VARIABLE = "DJANGO_SETTINGS_MODULE"

        if not self.SECRET_KEY:

            raise ImproperlyConfigured("The SECRET_KEY setting must not be empty.")

        if ('django.contrib.auth.middleware.AuthenticationMiddleware' in self.MIDDLEWARE_CLASSES and

                'django.contrib.auth.middleware.SessionAuthenticationMiddleware' not in self.MIDDLEWARE_CLASSES):

            warnings.warn(

                "Session verification will become mandatory in Django 1.10. "

                "Please add 'django.contrib.auth.middleware.SessionAuthenticationMiddleware' "

                "to your MIDDLEWARE_CLASSES setting when you are ready to opt-in after "

                "reading the upgrade considerations in the 1.8 release notes.",

                RemovedInDjango110Warning

            )

        if hasattr(time, 'tzset') and self.TIME_ZONE:

            # When we can, attempt to validate the timezone. If we can't find

            # this file, no check happens and it's harmless.

    'django.middleware.common.CommonMiddleware',

    'django.middleware.csrf.CsrfViewMiddleware',

    'django.contrib.auth.middleware.AuthenticationMiddleware',

    'django.contrib.auth.middleware.SessionAuthenticationMiddleware',

    'django.contrib.messages.middleware.MessageMiddleware',

    'django.middleware.clickjacking.XFrameOptionsMiddleware',

]

            backend = load_backend(backend_path)

            user = backend.get_user(user_id)

            # Verify the session

            if ('django.contrib.auth.middleware.SessionAuthenticationMiddleware'

                    in settings.MIDDLEWARE_CLASSES and hasattr(user, 'get_session_auth_hash')):

            if hasattr(user, 'get_session_auth_hash'):

                session_hash = request.session.get(HASH_SESSION_KEY)

                session_hash_verified = session_hash and constant_time_compare(

                    session_hash,

def update_session_auth_hash(request, user):

    """

    Updating a user's password logs out all sessions for the user if

    django.contrib.auth.middleware.SessionAuthenticationMiddleware is enabled.

    Updating a user's password logs out all sessions for the user.

    This function takes the current request and the updated user object from

    which the new session hash will be derived and updates the session hash

    correspond to the user's current session authentication hash. However, it

    caused the "Vary: Cookie" header on all responses.

    Now a backwards compatibility shim that enables session verification in

    auth.get_user() if this middleware is in MIDDLEWARE_CLASSES.

    It's now a shim to allow a single settings file to more easily support

    multiple versions of Django. Will be RemovedInDjango20Warning.

    """

    def process_request(self, request):

        pass

        if form.is_valid():

            form.save()

            # Updating the password logs out all other sessions for the user

            # except the current one if

            # django.contrib.auth.middleware.SessionAuthenticationMiddleware

            # is enabled.

            # except the current one.

            update_session_auth_hash(request, form.user)

            return HttpResponseRedirect(post_change_redirect)

    else: