[Fixed]-Django – check cookies's "SameSite" attribute

by

31👍

✅

I’ve also been having issues with cross-domain Cookies recently, and I’ve tracked it down to Google Chrome gradually rolling out their security update that forces the SameSite attribute to Lax if it isn’t set

Lax means that the Cookie is going to be blocked cross-domain by default on Google Chrome

Given that you’re inspecting the Cookie’s attributes in the code, I think that if the SameSite attribute isn’t there, than you’re not setting it and therefore Google Chrome is forcing the attribute to Lax

As you’ve stated you’re using Django 3.1, the following four entries in your settings.py file might resolve your issue (as it did for me):

CSRF_COOKIE_SECURE = True
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SAMESITE = 'None'
SESSION_COOKIE_SAMESITE = 'None'

Good luck!

👤LouieC

13👍

Going a little bit deeper.

  1. In production set:
CSRF_COOKIE_SECURE = True
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SAMESITE = 'None'
SESSION_COOKIE_SAMESITE = 'None'
  1. Do not set any of the above flags in development. It will say that cannot set the cookie with SameSite=None if the connection is NOT secure.

Also make sure that you have Django 3, in Django 2 there is a bug and it will output a ValueError.

👤juan Isaza

Leave a comment