#31934: Document that "SameSite" has defaults in some browsers.
--------------------------------------+------------------------------------
Reporter: אורי | Owner: nobody
Type: Cleanup/optimization | Status: new
Component: Documentation | Version: master
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
--------------------------------------+------------------------------------
Changes (by felixxm):
* type: Uncategorized => Cleanup/optimization
* stage: Unreviewed => Accepted
Comment:
> However, False means cookies will be sent without `SameSite`, which
means some browsers (Chrome, Dolphin) will give it default such as 'Lax',
which is different than what used to be in the past.
That's true, however this change is not related with Django but with a
different behavior of browsers. I think we can add a short note do
`False`, e.g.
{{{
``False``: disables the flag. Browsers can provide a more secure default
for `SameSite` if it's not specified explicitly, e.g. `Lax`.
}}}
> Also, document that with Chrome, if you use 'None' the cookie must be
secure.
This is a browser behavior and we're talking about Django's docs, I don't
think we should add this to our docs.
--
Ticket URL: <https://code.djangoproject.com/ticket/31934#comment:4>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/069.f106167ee604efe381dc50496d6cde53%40djangoproject.com.
