Frappe can't set a cookie's SameSite attribute to the string literal "None" because werkzeug is outdated

Description of the issue

Cookies may need the “SameSite” attribute set to the string literal “None”. They were set to None here, which means it defaults to “Lax” most of the time. It cannot be set to “None” unless werkzeug is updated to incorporate this change. I think therefore that frappe should use werkzeug 1.0.0 at least.

Context information (for bug reports)

I’m attempting to build a flutter application, which uses simple authentication. Hard-coding the changes described above, and the cookie’s “Secure” attribute allow me to retrieve the sid cookie, and authenticate my users in development.

Output of bench version

WARN: bench is installed in editable mode!

This is not the recommended mode of installation for production. Instead, install the package from PyPI with: `pip install frappe-bench`

5.0.0-dev

Steps to reproduce the issue

1. Set up a frappe backend
2. Set up a flutter client with the withCredentials attribute to send a login request
3. Send the login request

Observed result

The browser complains that the cookie could not be stored.

Expected result

The browser should just store the cookie, which flutter then handles.

[ceefour]

@ankush Thank you !!! So glad to hear that.

It’s unfortunate that ERPNext v13 can’t upgrade, but since there’s a workaround with nginx, this isn’t so bad.

Thank you @daraul for giving the workaround.

[daraul]

I took a wild guess based on this line and set the “device” parameter to “mobile” alongside my user’s login information. That did the trick, but I don’t recall seeing this functionality mentioned in the documentation. I would suggest the docs be updated in addition to werkzeug.