Re: [Django] #31934: Document that "SameSite" has defaults in some browsers. (was: SESSION_COOKIE_SAMESITE - document that unsetting "SameSite" has defaults in some browsers)
Django
--------------------------------------+------------------------------------
Reporter: אורי | Owner: nobody
Type: Cleanup/optimization | Status: new
Component: Documentation | Version: master
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
--------------------------------------+------------------------------------
Changes (by felixxm):
* type: Uncategorized => Cleanup/optimization
* stage: Unreviewed => Accepted
Comment:
> However, False means cookies will be sent without `SameSite`, which
means some browsers (Chrome, Dolphin) will give it default such as 'Lax',
which is different than what used to be in the past.
That's true, however this change is not related with Django but with a
different behavior of browsers. I think we can add a short note do
`False`, e.g.
{{{
``False``: disables the flag. Browsers can provide a more secure default
for `SameSite` if it's not specified explicitly, e.g. `Lax`.
}}}
> Also, document that with Chrome, if you use 'None' the cookie must be
secure.
This is a browser behavior and we're talking about Django's docs, I don't
think we should add this to our docs.
--
Ticket URL: <https://code.djangoproject.com/ticket/31934#comment:4>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.