Search code examples
djangogoogle-chromecookiessession-cookiessamesite

Third party cookies not set on Chrome (Django App)

I am having problems accessing some third-party cookies on Chrome.

Chrome version is 80.0.3987.100 (Official Build) (64-bit) and I suppose this already have the new implementation of SameSite cookies set to Lax.

However, in the Django settings I have added the following:

SESSION_COOKIE_SECURE = True
SESSION_COOKIE_SAMESITE = None
CSRF_COOKIE_SAMESITE = None

with no luck.

enter image description here

You can see there are no Cookies in the Request header above

enter image description here

I have tried the request I am having troubles executing from Chrome on Postman. I get exactly the same result until I pass Cookie: sessionid: <some_id>. It probably is worth mentioning that this whole things works with no problems on Firefox (where I can see the Cookie set properly in the request Headers).

If anyone has any ideas it would be greatly appreciated.

Solution

  • OK found the solution!

    Based on the conversations on this PR I decided to go for the following workaround:

    1. Create the following middleware
    2. Add the middleware before django.contrib.sessions.middleware.SessionMiddleware
    3. Still keep those settings.

    =>

    SESSION_COOKIE_SECURE = True
SESSION_COOKIE_SAMESITE = None
CSRF_COOKIE_SAMESITE = None

    The PR above is already merged into master and it will be released sometime in August 2020. Until then, this is the best workaround.