Skip to main content

Middleware which sets SameSite flag for session and csrf cookies in legacy versions of Django.

Project description

https://badge.fury.io/py/django-cookies-samesite.svg https://travis-ci.org/jotes/django-cookies-samesite.svg?branch=master https://codecov.io/gh/jotes/django-cookies-samesite/branch/master/graph/badge.svg

Django 3.1.x introduces full support of SameSite flag for session and csrf cookie.

Unfortunately, this functionality will not be ported to older versions of Django e.g. 1.11.x or 2.2.x

This repository contains a middleware which automatically sets SameSite attribute for session and csrf cookies in legacy versions of Django.

Quickstart

Install django-cookies-samesite:

pip install django-cookies-samesite

Add the middleware to the top of MIDDLEWARE_CLASSES:

MIDDLEWARE_CLASSES = (
    'django_cookies_samesite.middleware.CookiesSameSite',
    ...
)

Set your preferred SameSite policy in settings.py: .. code-block:: python

SESSION_COOKIE_SAMESITE = ‘lax’ # or DCS_SESSION_COOKIE_SAMESITE = ‘Lax’

This can be ‘Lax’, ‘None’, ‘Strict’, or None to disable the flag. Also, you can set this flag in your custom cookies:

SESSION_COOKIE_SAMESITE_KEYS = {'my-custom-cookies'}
# or
DCS_SESSION_COOKIE_SAMESITE_KEYS = {'my-custom-cookies'}

After that you should be able to see the SameSite flag set for session and csrf cookies.

You can set the SameSite flag on all cookies (even on those coming from third-party Django apps):

SESSION_COOKIE_SAMESITE_FORCE_ALL = True
# or
DCS_SESSION_COOKIE_SAMESITE_FORCE_ALL = True

Running Tests

Does the code actually work?

source <YOURVIRTUALENV>/bin/activate
(myenv) $ pip install tox
(myenv) $ tox

Credits

Tools used in rendering this package:

Contributors

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

django-cookies-samesite-0.6.0.tar.gz (6.8 kB view hashes)

Uploaded Source

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page