defer looking up headers until the response callback is called (FBO things like sessionauthenticationpolicy which does its own header-setting when its remember/forget methods are called)

1 files changed, 2 insertions, 2 deletions

diff --git a/pyramid/security.py b/pyramid/security.py
index 1b52c9cb5..afca8cd9a 100644
--- a/pyramid/security.py
+++ b/pyramid/security.py
@@ -408,12 +408,12 @@ class AuthenticationAPIMixin(object):
         .. versionadded:: 1.5
 
         """
-        headers = self._remember_userid(principal, **kw)
         def callback(req, response):
             # do not set the headers on an exception unless explicitly
             # instructed
             exc = getattr(req, 'exception', None)
             if exc is None or on_exception:
+                headers = self._remember_userid(principal, **kw)
                 response.headerlist.extend(headers)
         self.add_response_callback(callback)
 
@@ -449,10 +449,10 @@ class AuthenticationAPIMixin(object):
 
         .. versionadded:: 1.5
         """
-        headers = self._forget_userid()
         def callback(req, response):
             exc = getattr(req, 'exception', None)
             if exc is None or on_exception:
+                headers = self._forget_userid()
                 response.headerlist.extend(headers)
         self.add_response_callback(callback)