Weblate crashing with remote user authentication after updating to v5.10.4

[joonashak]

Previously, I had a working setup with Weblate v5.9.2.2 using Django's remote user authentication. After updating to 5.10.4. Weblate started crashing upon page load with a stack trace pointing to a file in Weblate source code:

weblate-1  | gunicorn stderr | Internal Server Error: /
weblate-1  | gunicorn stderr | Traceback (most recent call last):
weblate-1  | gunicorn stderr |   File "/app/venv/lib/python3.13/site-packages/django/core/handlers/exception.py", line 55, in inner
weblate-1  | gunicorn stderr |     response = get_response(request)
weblate-1  | gunicorn stderr |   File "/app/venv/lib/python3.13/site-packages/django/utils/deprecation.py", line 128, in __call__
weblate-1  | gunicorn stderr |     response = self.process_request(request)
weblate-1  | gunicorn stderr |   File "/app/venv/lib/python3.13/site-packages/django/contrib/auth/middleware.py", line 143, in process_request
weblate-1  | gunicorn stderr |     user = auth.authenticate(request, remote_user=username)
weblate-1  | gunicorn stderr |   File "/app/venv/lib/python3.13/site-packages/django/views/decorators/debug.py", line 75, in sensitive_variables_wrapper
weblate-1  | gunicorn stderr |     return func(*func_args, **func_kwargs)
weblate-1  | gunicorn stderr |   File "/app/venv/lib/python3.13/site-packages/django/contrib/auth/__init__.py", line 79, in authenticate
weblate-1  | gunicorn stderr |     user = backend.authenticate(request, **credentials)
weblate-1  | gunicorn stderr |   File "/app/venv/lib/python3.13/site-packages/django/contrib/auth/backends.py", line 202, in authenticate
weblate-1  | gunicorn stderr |     user, created = UserModel._default_manager.get_or_create(
weblate-1  | gunicorn stderr |                     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
weblate-1  | gunicorn stderr |         **{UserModel.USERNAME_FIELD: username}
weblate-1  | gunicorn stderr |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
weblate-1  | gunicorn stderr |     )
weblate-1  | gunicorn stderr |     ^
weblate-1  | gunicorn stderr |   File "/app/venv/lib/python3.13/site-packages/django/db/models/manager.py", line 87, in manager_method
weblate-1  | gunicorn stderr |     return getattr(self.get_queryset(), name)(*args, **kwargs)
weblate-1  | gunicorn stderr |            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^
weblate-1  | gunicorn stderr |   File "/app/venv/lib/python3.13/site-packages/weblate/auth/models.py", line 348, in get_or_create
weblate-1  | gunicorn stderr |     for name, value in defaults.items()
weblate-1  | gunicorn stderr |                        ^^^^^^^^^^^^^^
weblate-1  | gunicorn stderr | AttributeError: 'NoneType' object has no attribute 'items'

The line in question is here. To me, this seems like a possible bug, since .items() is called on a value that is possibly None without guarding against NoneType prior.

I am not a Python expert and even less so with Django, so I decided to start a discussion rather than opening a bug ticket right away. Do you think this is an issue with Weblate or my setup (see below)?

I am using both a custom middleware configuration and a custom backend like so:

AUTHENTICATION_BACKENDS = [
    "kieku.auth.RemoteUserBackend",
    "weblate.accounts.auth.WeblateUserBackend",
]

MIDDLEWARE += [
    "django.contrib.auth.middleware.AuthenticationMiddleware",
    "kieku.auth.RemoteUserMiddleware",
]

The middleware specifies the name of the HTTP header containing the authenticated user's username as per Django's docs. That works fine with v5.10.4. In other words, dropping my custom backend from AUTHENTICATION_BACKENDS and including the default django.contrib.auth.backends.RemoteUserBackend works as expected.

The custom backend inherits from django.contrib.auth.backends.RemoteUserBackend and aims to add some user details (full name and e-mail address) from the headers. This is what the auth customization looks like as a whole:

from django.contrib.auth import get_user_model
from django.contrib.auth.backends import RemoteUserBackend as DjangoRemoteUserBackend
from django.contrib.auth.middleware import (
    RemoteUserMiddleware as DjangoRemoteUserMiddleware,
)

UserModel = get_user_model()


class RemoteUserMiddleware(DjangoRemoteUserMiddleware):
    """
    Make django.contrib.auth.backends.RemoteUserBackend read username from our custom header.
    See https://docs.djangoproject.com/en/5.1/howto//auth-remote-user/ .
    """

    header = "HTTP_X_USER"


class RemoteUserBackend(DjangoRemoteUserBackend):
    def configure_user(self, request, user, **kwargs):
        """
        After authentication, update the user's e-mail and full name fields with values from
        Shibboleth headers.
        """
        user = super().configure_user(request, user, **kwargs)

        email = request.META.get("HTTP_X_EMAIL")
        if email:
            user.email = email

        full_name = request.META.get("HTTP_X_FULLNAME")
        if full_name:
            user.full_name = full_name

        user.save()
        return user

If I replace the backend class with just

class RemoteUserBackend(DjangoRemoteUserBackend):
    pass

I still get the same error. This leads me to suspect that commit 202520b might be the culprit rather than my RemoteUserBackend implementation.

What do you think? Should I open a bug issue for this? If the problem is not with Weblate, I'd much appreciate any pointers as to what I'm messing up with the customization. Like I said, it worked before, leading me to believe it is correct, but my Django knowledge is very limited so I'm pretty stuck with debugging this at the moment.

Thank you very much!

[nijel]

Definitely a bug introduced in #13640, created #14434 to track this.

[joonashak]

Many thanks! 🙏