From b33bfc383935cd26e19a2cf71d066ac6edd1425f Mon Sep 17 00:00:00 2001 From: Osaetin Daniel Date: Wed, 9 Oct 2019 07:42:55 -0400 Subject: Fixed #30862 -- Allowed setting SameSite cookies flags to 'none'. Thanks Florian Apolloner and Carlton Gibson for reviews. --- django/http/response.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'django/http') diff --git a/django/http/response.py b/django/http/response.py index 269953c0af..596732a5b8 100644 --- a/django/http/response.py +++ b/django/http/response.py @@ -197,8 +197,8 @@ class HttpResponseBase: if httponly: self.cookies[key]['httponly'] = True if samesite: - if samesite.lower() not in ('lax', 'strict'): - raise ValueError('samesite must be "lax" or "strict".') + if samesite.lower() not in ('lax', 'none', 'strict'): + raise ValueError('samesite must be "lax", "none", or "strict".') self.cookies[key]['samesite'] = samesite def setdefault(self, key, value): -- cgit v1.3