SimpleUser and UnauthenticatedUser don't implement BaseUser.identity

[navidnabavi]

Bug

BaseUser defines identity as an abstract property (raises NotImplementedError).
Neither SimpleUser nor UnauthenticatedUser implement it.

Code

# starlette/authentication.py

class BaseUser:
    @property
    def identity(self) -> str:
        raise NotImplementedError()  # line 118

class SimpleUser(BaseUser):
    # implements is_authenticated, display_name
    # missing: identity ❌

class UnauthenticatedUser(BaseUser):
    # implements is_authenticated, display_name
    # missing: identity ❌

Reproduction

from starlette.authentication import SimpleUser, UnauthenticatedUser

user = SimpleUser("alice")
print(user.identity)  # raises NotImplementedError

anon = UnauthenticatedUser()
print(anon.identity)  # raises NotImplementedError

Expected

SimpleUser.identity → return username
UnauthenticatedUser.identity → return "" (or raise AuthenticationError)

Fix

Add identity property to both classes.

[ltianyi992]

This is a genuine gap in the built-in classes. BaseUser.identity raises NotImplementedError but neither SimpleUser nor UnauthenticatedUser provide an implementation.

The fix is straightforward — two property additions in starlette/authentication.py:

class SimpleUser(BaseUser):
    def __init__(self, username: str) -> None:
        self.username = username

    @property
    def is_authenticated(self) -> bool:
        return True

    @property
    def display_name(self) -> str:
        return self.username

    @property
    def identity(self) -> str:  # ← add this
        return self.username


class UnauthenticatedUser(BaseUser):
    @property
    def is_authenticated(self) -> bool:
        return False

    @property
    def display_name(self) -> str:
        return ""

    @property
    def identity(self) -> str:  # ← add this
        return ""

Rationale:

• SimpleUser.identity returning username is the natural choice — identity is the unique key that was authenticated, which is the username.
• UnauthenticatedUser.identity returning "" (empty string) is consistent with display_name and signals "no identity" without raising.

A PR with these two additions plus tests (assert SimpleUser("alice").identity == "alice" etc.) would be a clean, minimal fix. The change is backward-compatible — nothing currently calls .identity on these classes successfully, so adding the property only adds capability.

[navidnabavi]

This PR tried to fix the issue. #3271