repoze.who

What it is and what it does

repoze.who is a WSGI-based identification and authentication framework inspired by Zope's Pluggable Authentication Service. It sits between your web application and the WSGI server, extracting user identity from requests and managing login/logout flows through pluggable components. The framework handles the 'who are you' question but deliberately leaves authorization (what users can do) to your application.

You can deploy it as WSGI middleware wrapping your application or use its API directly within your code. It depends on WebOb for HTTP request/response handling and zope.interface for plugin contracts. On Python 3.13 or higher, legacy-cgi is required so WebOb works. The package supports Python 3.9 through 3.13 and has been stable since its early releases, though updates are infrequent.

Use it for:

• Add authentication to a legacy or custom WSGI application without rewriting the entire auth layer.
• Integrate multiple authentication methods (cookies, form-based, htpasswd files) into a single WSGI middleware stack.
• Delegate user identification to repoze.who middleware while your application focuses solely on authorization and business logic.
• Migrate authentication from Zope 2's PAS to a standalone WSGI framework that works with any WSGI-compatible web stack.
• Build a multi-tenant WSGI application where different auth plugins handle different user populations.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

repoze.who is an identification and authentication framework for WSGI applications, configurable as middleware or an API to handle user identification without providing authorization logic.

Yes, if you are building or maintaining a WSGI application that needs pluggable authentication and you accept infrequent updates. The package is stable, has no known vulnerabilities, and supports modern Python versions. It is not suitable if you need active development, frequent security patches, or integration with modern async frameworks (it is WSGI-only, not ASGI).

Install

repoze-who on PyPI

pip install repoze-who

uv add repoze-who

poetry add repoze-who

Installing repoze.who

Before you install

Low install friction with a pure-Python wheel. Maintenance status is aging—last release was 538 days ago—but the package is marked Production/Stable and supports current Python versions (3.9–3.13). No known vulnerabilities.

License in practice

BSD-derived permissive license allows use in most commercial and open-source projects with minimal restrictions; consult the license text at http://www.repoze.org/LICENSE.txt for exact terms.

Quickstart

pip install repoze.who

from repoze.who.middleware import IdentificationMiddleware
from repoze.who.plugins.auth_tkt import AuthTktCookiePlugin

plugin = AuthTktCookiePlugin(secret='my-secret')
app_with_auth = IdentificationMiddleware(app, [plugin])

Requires Python 3.9 or higher; on Python 3.13 or higher, legacy-cgi must be installed for WebOb compatibility.

Verify before relying

• Whether the aging maintenance status (538 days since last release) affects real-world compatibility with recent WSGI frameworks or if the package is stable-by-design.
• Whether the four runtime dependencies introduce any transitive security or compatibility concerns beyond what the fact sheet shows.

Package facts

Evidence: repoze.who-3.1.0-py3-none-any.whl

Keywords: web, application, server, wsgi, zope

Tags

More WWW/HTTP packages