Explicitly SameSite: None cookies.

[Osaetin Daniel]

When setting cookies (with .set_cookie and set_signed_cookie) the default value for the samesite argument is None but the problem here is that Django doesn't do anything with the None value.

This behaviour used to be fine because most browsers assumed that a missing samesite attribute on a cookie meant None. But now, Chrome has issued a warning that samesite has to be explicitly set to None else the cookies won't be sent for cross-origin requests.

​https://www.chromestatus.com/feature/5633521622188032

[Carlton Gibson]

Hi.

The link you've given implies that if samesite is None then we must set secure — ​we're not doing that so we should add an extra clause in there.

Chrome has issued a warning that samesite has to be explicitly set to None else the cookies won't be sent for cross-origin requests.

Is this the same point? (It reads differently to me at first glance.)

[Osaetin Daniel]

Replying to Carlton Gibson:

Hi.

The link you've given implies that if samesite is None then we must set secure — ​we're not doing that so we should add an extra clause in there.

Chrome has issued a warning that samesite has to be explicitly set to None else the cookies won't be sent for cross-origin requests.

Is this the same point? (It reads differently to me at first glance.)

My bad. The title of the ticket is misleading What I meant to say was to "allow the option to set 'same-site' to 'None'". At the moment, you can only set it to "Strict" or "Lax".

This statement "The link you've given implies that if samesite is None then we must set secure" is correct but I think the best thing is to be as flexible as possible. Although Chrome's warning has good intentions, it is not a global browser standard and other users (For reasons best known to them) might want to set the secure flag without samesite and vice-versa.
So in this case, the best option, In my opinion, is to allow "None" (as a string) without enforcing secure=True and at the same time preserve the current behaviour.

Perhaps I jumped the gun with this but I've already opened a PR that communicates my intentions: ​https://github.com/django/django/pull/11894

[Carlton Gibson]

OK, thank for the update. Makes sense. I've re-titled again accordingly.

...I've already opened a PR ...

Gun jumping of that kind we very much like. 🙂

Thanks.

[Mariusz Felisiak <felisiak.mariusz@…>]

In b33bfc3:

Fixed #30862 -- Allowed setting SameSite cookies flags to 'none'.

Thanks Florian Apolloner and Carlton Gibson for reviews.

[אורי]

I created issue #31933.

I think this change should be backported to all working versions of Django, to allow setting SESSION_COOKIE_SAMESITE = 'None' manually in all versions, which are still in use until 2022.