diff options
| author | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2020-07-16 09:30:15 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-07-16 09:30:15 +0200 |
| commit | 331324ecce1330dce3dbd1713203cb9a42854ad7 (patch) | |
| tree | 84dd89a08adf375e40591834af6de87906d52108 /django/http | |
| parent | 419a78300f7cd27611196e1e464d50fd0385ff27 (diff) | |
[3.0.x] Fixed #31790 -- Fixed setting SameSite cookies flag in HttpResponse.delete_cookie().
Cookies with the "SameSite" flag set to None and without the "secure"
flag will be soon rejected by latest browser versions.
This affects sessions and messages cookies.
Backport of 240cbb63bf9965c63d7a3cc9032f91410f414d46 from master.
Diffstat (limited to 'django/http')
| -rw-r--r-- | django/http/response.py | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/django/http/response.py b/django/http/response.py index c33feb97c4..d98c040d91 100644 --- a/django/http/response.py +++ b/django/http/response.py @@ -209,13 +209,13 @@ class HttpResponseBase: value = signing.get_cookie_signer(salt=key + salt).sign(value) return self.set_cookie(key, value, **kwargs) - def delete_cookie(self, key, path='/', domain=None): + def delete_cookie(self, key, path='/', domain=None, samesite=None): # Most browsers ignore the Set-Cookie header if the cookie name starts # with __Host- or __Secure- and the cookie doesn't use the secure flag. secure = key.startswith(('__Secure-', '__Host-')) self.set_cookie( key, max_age=0, path=path, domain=domain, secure=secure, - expires='Thu, 01 Jan 1970 00:00:00 GMT', + expires='Thu, 01 Jan 1970 00:00:00 GMT', samesite=samesite, ) # Common methods used by subclasses |