Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

CORS_ALLOW_CREDENTIALS documentation should include a note about cookie samesite settings

See original GitHub issue

CORS_ALLOW_CREDENTIALS allows cookies to be sent in cross-domain responses, but the default settings on SESSION_COOKIE_SAMESITE is "Lax" instead of None, meaning the cookie won’t get sent anyway. It isn’t required, since there might be other cookies you want to send, but a note would be nice.

Issue Analytics

State:
Created 5 years ago
Reactions:3
Comments:6 (4 by maintainers)

Top GitHub Comments

2reactions

mark-slepkovcommented, Mar 3, 2019

@jonathan-golorry Thank you for your comment. I have spent almost 1 day trying to find where the trouble is.

0reactions

adamchainzcommented, Mar 29, 2019

Indeed it should not!

Top Results From Across the Web

CORS_ALLOW_CREDENTIALS documentation ... - GitHub

CORS_ALLOW_CREDENTIALS allows cookies to be sent in cross-domain responses, ... should include a note about cookie samesite settings #344.

SameSite cookies - HTTP - MDN Web Docs

The SameSite attribute of the Set-Cookie HTTP response header allows you to declare if your cookie should be restricted to a first-party or ......

SameSite cookies explained - web.dev

Learn how to mark your cookies for first-party and third-party usage with the SameSite attribute. You can enhance your site's security by ...

Work with SameSite cookies in ASP.NET Core | Microsoft Learn

Setting the SameSite property to Strict , Lax , or None results in those values being written on the network with the cookie....

Get Ready for New SameSite=None; Secure Cookie Settings

With Chrome 80 in February, Chrome will treat cookies that have no declared SameSite value as SameSite=Lax cookies. Only cookies with the SameSite=None...