mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-24 14:16:09 +00:00
Code Issues 32 Releases Wiki Activity

Fixed #31790 -- Fixed setting SameSite and Secure cookies flags in HttpResponse.delete_cookie().

Browse Source 
Cookies with the "SameSite" flag set to None and without the "secure"
flag will be soon rejected by latest browser versions.

This affects sessions and messages cookies.
This commit is contained in:
Mariusz Felisiak
2020-07-16 08:16:58 +02:00
committed by GitHub
parent 156a2138db
commit 240cbb63bf
10 changed files with 66 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
tests/responses/test_cookie.py
View File

@@ -105,6 +105,7 @@ class DeleteCookieTests(SimpleTestCase):
self.assertEqual(cookie['path'], '/')
self.assertEqual(cookie['secure'], '')
self.assertEqual(cookie['domain'], '')
self.assertEqual(cookie['samesite'], '')
def test_delete_cookie_secure_prefix(self):
"""
@@ -118,3 +119,14 @@ class DeleteCookieTests(SimpleTestCase):
cookie_name = '__%s-c' % prefix
response.delete_cookie(cookie_name)
self.assertIs(response.cookies[cookie_name]['secure'], True)
def test_delete_cookie_secure_samesite_none(self):
# delete_cookie() sets the secure flag if samesite='none'.
response = HttpResponse()
response.delete_cookie('c', samesite='none')
self.assertIs(response.cookies['c']['secure'], True)
def test_delete_cookie_samesite(self):
response = HttpResponse()
response.delete_cookie('c', samesite='lax')
self.assertEqual(response.cookies['c']['samesite'], 'lax')