Django HTTP response always sets `sessionid` cookie and session data do not persist

I have created a custom backend and related middleware which log users in on the sole condition that an ID_TOKEN cookie is passed along with the request.

My code is extensively based on django.contrib.auth.backends.RemoteUserBackend and its related middleware middleware django.contrib.auth.middleware.RemoteUserMiddleware.

Here is my middleware:

import hashlib

from django.conf import settings
from django.contrib import auth
from django.core.exceptions import ImproperlyConfigured, PermissionDenied
from django.urls import reverse
from django.utils.deprecation import MiddlewareMixin
from main.auth.backends import MyRemoteUserBackend
from main.auth.jwt import JWT

logger = logging.getLogger(__name__)


class AllowAllUsersMiddleware(MiddlewareMixin):

    def process_request(self, request):
        if not hasattr(request, "user"):
            raise ImproperlyConfigured(
                "Requires 'AuthenticationMiddleware' in middleware"
            )

        try:
            id_token = request.COOKIES["ID-TOKEN"]
        except KeyError:
            if request.user.is_authenticated:
                self._remove_invalid_user(request)

            return

        token = JWT(id_token)
        id_token_digest = hashlib.sha256(id_token.encode(), usedforsecurity=False).hexdigest()
        has_id_token_digest_changed = id_token_digest != request.session.get("id_token_digest", "")

        if request.user.is_authenticated:
            if request.user.get_username() == token.username and not has_id_token_digest_changed:
                return  # username and token did not change, do nothing

            self._remove_invalid_user(request)

        user = auth.authenticate(request, token=token)

        if user:
            request.user = user
            auth.login(request, user)
            request.session["id_token_digest"] = id_token_digest

    def _remove_invalid_user(self, request):
        auth.logout(request)

And here is my backend:

from typing import Optional

from django.conf import settings
from django.contrib.auth import get_user_model
from django.contrib.auth.backends import ModelBackend
from django.contrib.auth.models import Group
from main.auth.jwt import JWT

UserModel = get_user_model()


class MyRemoteUserBackend(ModelBackend):
    def authenticate(self, request, token: JWT) -> Optional[UserModel]:
        if not token:
            return

        user, _ = UserModel._default_manager.get_or_create(username=token.username)

        return user

My production settings are the following:

AUTHENTICATION_BACKENDS = [
    "main.auth.backends.MyRemoteUserBackend",  # custom backend
]

MIDDLEWARE = [
    "django.middleware.security.SecurityMiddleware",
    "django.contrib.sessions.middleware.SessionMiddleware",
    "django.middleware.locale.LocaleMiddleware",
    "django.middleware.common.CommonMiddleware",
    "django.middleware.csrf.CsrfViewMiddleware",
    "django.contrib.auth.middleware.AuthenticationMiddleware",
    "main.auth.middleware.AllowAllUsersMiddleware",  # custom middleware
    "django.contrib.messages.middleware.MessageMiddleware",
    "django.middleware.clickjacking.XFrameOptionsMiddleware",
]

SESSION_COOKIE_SECURE = True
SESSION_COOKIE_SAMESITE = "Strict"

Dealing with custom session data is working fine locally (I inject a request cookie for the ID-TOKEN with another custom middleware). In production, the sessionid cookie gets reset after each request/response. From what I can see in my Firefox network tab, a set-cookie header is always sent with the HTTP response, causing session data to be lost (session entry named "id_token_digest").

Here is one set-cookie example in production: set-cookie sessionid=rlc...tn; expires=Mon, 03 Feb 2025 14:29:53 GMT; HttpOnly; Max-Age=1209600; Path=/; SameSite=Lax; Secure

Has anyone dealt with such problem before? Is my middleware onion layering wrong?

Thanks to you Abdul Aziz Barkat, I could narrow the issue down to a too restrictive AWS CloudFront cookie whitelist. Thank you!

Addind both Django's default sessionid and csrftoken cookie names to whitelisted cookies solved my issue (session is persisted along with session data and CSRF verification succeeds).

For those of you who are interested in some Cloud / IaC related issues, remember you have to set CloudFront's Cookies policy properly. Here is some Terraform documentation about this.