search

bbangert / beaker

WSGI middleware for sessions and caching
https://beaker.readthedocs.org/
Other
517 stars 146 forks source link

Set SameSite option on session cookies #158

Closed alex closed 6 years ago

alex commented 6 years ago

Documented here: https://blog.mozilla.org/security/2018/04/24/same-site-cookies-in-firefox-60/

Currently supported in Firefox and Chromium; it provides strong defense in depth against CSRF.

alex commented 6 years ago

Assuming there's interest, I'm happy to add support.

amol- commented 6 years ago

That sounds like a very good idea.

I think a proposed implementation should act in "Lax" mode and support a way to disable it / switch to Safe.

If you are willing to provide a PR I'll gladly review and merge it.