{"categories":[{"label":"WWW/HTTP","url":"https://skillfed.io/packages/category/internet-www-http/6"},{"label":"Dynamic Content","url":"https://skillfed.io/packages/category/internet-www-http-dynamic-content/3"},{"label":"WSGI","url":"https://skillfed.io/packages/category/internet-www-http-wsgi"},{"label":"Application","url":"https://skillfed.io/packages/category/internet-www-http-wsgi-application"}],"enrichment":{"capability":"repoze.who is an identification and authentication framework for WSGI applications, configurable as middleware or an API to handle user identification without providing authorization logic.","skillfed_tags":["wsgi-middleware","authentication","legacy-framework"],"use_cases":["Add authentication to a legacy or custom WSGI application without rewriting the entire auth layer.","Integrate multiple authentication methods (cookies, form-based, htpasswd files) into a single WSGI middleware stack.","Delegate user identification to repoze.who middleware while your application focuses solely on authorization and business logic.","Migrate authentication from Zope 2's PAS to a standalone WSGI framework that works with any WSGI-compatible web stack.","Build a multi-tenant WSGI application where different auth plugins handle different user populations."],"what_it_does":"repoze.who is a WSGI-based identification and authentication framework inspired by Zope's Pluggable Authentication Service. It sits between your web application and the WSGI server, extracting user identity from requests and managing login/logout flows through pluggable components. The framework handles the 'who are you' question but deliberately leaves authorization (what users can do) to your application.\n\nYou can deploy it as WSGI middleware wrapping your application or use its API directly within your code. It depends on WebOb for HTTP request/response handling and zope.interface for plugin contracts. On Python 3.13 or higher, legacy-cgi is required so WebOb works. The package supports Python 3.9 through 3.13 and has been stable since its early releases, though updates are infrequent.","worth_installing":"Yes, if you are building or maintaining a WSGI application that needs pluggable authentication and you accept infrequent updates. The package is stable, has no known vulnerabilities, and supports modern Python versions. It is not suitable if you need active development, frequent security patches, or integration with modern async frameworks (it is WSGI-only, not ASGI)."},"id":"repoze-who","links":{"html":"https://skillfed.io/packages/repoze-who","md":"https://skillfed.io/packages/repoze-who.md","pypi":"https://pypi.org/project/repoze-who/"},"maintenance":{"status":"aging"},"meta":{"latest_release":"2025-02-22","license_spdx":null,"license_treatment":"permissive","name":"repoze.who","python_support":"supports_current","summary":"repoze.who is an identification and authentication framework for WSGI."},"popularity":{"monthly_downloads":167409,"position":10471,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"3.1.0"}