Django 3.1.x introduces full support of SameSite flag for session and csrf cookie.
Unfortunately, this functionality will not be ported to older versions of Django e.g. 1.11.x or 2.2.x
This repository contains a middleware which automatically sets SameSite attribute for session and csrf cookies in legacy versions of Django.
Quickstart
Install django-cookies-samesite:
pip install django-cookies-samesite
Add the middleware to the top of MIDDLEWARE_CLASSES:
MIDDLEWARE_CLASSES = (
'django_cookies_samesite.middleware.CookiesSameSite',
...
)Set your preferred SameSite policy in settings.py: .. code-block:: python
SESSION_COOKIE_SAMESITE = ‘lax’ # or DCS_SESSION_COOKIE_SAMESITE = ‘Lax’
This can be ‘Lax’, ‘None’, ‘Strict’, or None to disable the flag. Also, you can set this flag in your custom cookies:
SESSION_COOKIE_SAMESITE_KEYS = {'my-custom-cookies'}
# or
DCS_SESSION_COOKIE_SAMESITE_KEYS = {'my-custom-cookies'}After that you should be able to see the SameSite flag set for session and csrf cookies.
You can set the SameSite flag on all cookies (even on those coming from third-party Django apps):
SESSION_COOKIE_SAMESITE_FORCE_ALL = True
# or
DCS_SESSION_COOKIE_SAMESITE_FORCE_ALL = TrueRunning Tests
Does the code actually work?
source <YOURVIRTUALENV>/bin/activate (myenv) $ pip install tox (myenv) $ tox
Credits
Tools used in rendering this package:
Contributors
Jørn Lomax <northlomax@gmail.com>
Antoine Lefebvre-Brossard <antoinelb@protonmail.com>
Code Hugger (Matthew Jones) <jonespm@umich.edu>
Mykolas Kvieska <mykolas921@gmail.com>
Liuyang Wan <tsfdye@gmail.com>
1 maintainer
Release files for django-cookies-samesite 0.6.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| django-cookies-samesite-0.6.0.tar.gz | 6.8 kB | Details |
