id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
30250	Due to iOS Safari 12 issue, SameSite flag on session and CSRF cookies should NOT be Lax by default	Flávio Juvenal	nobody	"There's a [https://bugs.webkit.org/show_bug.cgi?id=188165 iOS Safari 12 issue] that prevents common flows (sequences of requests) to work properly if there's `SameSite=lax` on cookies. This issue was [https://bugs.webkit.org/show_bug.cgi?id=188165#c27 confirmed by Daniel Bates, from Apple] and it's still open.

Examples of broken flows:
- OpenIdConnect: https://community.auth0.com/t/authentication-broken-on-asp-net-core-and-safari-on-ios-12-mojave-take-2/19104
- Shopify app OAuth flow: https://www.calazan.com/django-21-samesite-cookie-issue-with-safari-12/
- Clicking a link on an email: https://bugs.webkit.org/show_bug.cgi?id=188165#c40
- SAML flow: https://github.com/IronCountySchoolDistrict/django-python3-saml/issues/1

Since Safari 12 is the current stable version and it's widely deployed on iOS devices, I believe the Django default for `CSRF_COOKIE_SAMESITE` and `SESSION_COOKIE_SAMESITE` should be `None`, not `Lax`. That's the most general solution and it's [https://github.com/aspnet/Announcements/issues/318 the one recommended by Microsoft to fix the similar issue on ASP.NET].

Core developers, could you please let me know if you agree with that change, so I can make a PR updating the defaults and the documentation?

I think both CSRF and Session cookies shouldn't have the SameSite flag because I've found many 403 Forbidden issues on both on Safari 12. If more steps to reproduce beyond the links above are necessary, please let me know."	Bug	new	Uncategorized	2.1	Normal		samesite,csrf,session,cookies		Unreviewed	0	0	0	0	1	0