JWT_COOKIE_SAMESITE = 'None' not being respected

Hi! I have installed version 0.3.1 as my pipenv update --outdated show: django-graphql-jwt: 0.3.1 installed, 0.3.1 required (Unpinned in Pipfile), 0.3.1 available.

And recently with the new change on Chrome policy regarding the cookies I saw that we needed to secure cookies when setting samesite none. More here

However, although I explicitly set this setting accordingly:

GRAPHQL_JWT = {
    'JWT_ALLOW_ARGUMENT': False,
    'JWT_HIDE_TOKEN_FIELDS': True,
    'JWT_VERIFY_EXPIRATION': True,
    'JWT_LONG_RUNNING_REFRESH_TOKEN': True,
    'JWT_EXPIRATION_DELTA': timedelta(minutes=15),
    'JWT_REFRESH_EXPIRATION_DELTA': timedelta(days=7),
    'JWT_COOKIE_SECURE': config('JWT_COOKIE_SECURE', cast=bool, default=True),
    'JWT_COOKIE_SAMESITE': 'None',
    'JWT_CSRF_ROTATION': True,
}

The cookie is being delivered secure but the SAMESITE property is delivered as Lax. I saw the PR #214, actually I had the latest version by that moment and I reinstall, check everything becuase of this new policy, and while Django settings regarding CSRF are working (on chrome I’m receiveng correct props), this one doesn’t

My Django settings that are working:

CSRF_COOKIE_SAMESITE = 'None'
CSRF_COOKIE_SECURE = config(
    'CSRF_COOKIE_SECURE', default=True, cast=bool)
SESSION_COOKIE_SAMESITE = 'None'
SESSION_COOKIE_SECURE = config(
    'SESSION_COOKIE_SECURE', default=True, cast=bool)

[fbennets]

It’s really confusing that this feature is already part of the documentation but not implemented. @mongkok should I make a PR with a comment in the documentation? I guess that would be really helpful.

This version is still not available on PyPi, any advice on how I can work around this for now?

For me, the repo currently contains breaking changes. Therefore I forked the repo, rolled back to the code used for version 0.31 and just added the two lines (see here).

Feel free to use this modified version (just paste this into your requirements): git+git://github.com/open-decision/django-graphql-jwt@mod#egg=django-graphql-jwt

[deanpienaar]

👍 Yeah. Would really appreciate this feature being released.