maya-chen/flask
1
0
Fork 0
forked from orbit-oss/flask
Code Pull requests Activity

add SESSION_COOKIE_PARTITIONED config

Browse source 
co-authored-by: Jose Cespedes <josecespedes@ibm.com>
This commit is contained in:
David Lord 2024-06-09 19:55:22 -06:00
parent 6f2014d353
commit 9efc1ebeeb
No known key found for this signature in database
GPG key ID: 43368A7AA8CC5926
5 changed files with 34 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

17
docs/config.rst
View file

@ -173,6 +173,23 @@ The following configuration values are used internally by Flask:
Default: ``False``
.. py:data:: SESSION_COOKIE_PARTITIONED
Browsers will send cookies based on the top-level document's domain, rather
than only the domain of the document setting the cookie. This prevents third
party cookies set in iframes from "leaking" between separate sites.
Browsers are beginning to disallow non-partitioned third party cookies, so
you need to mark your cookies partitioned if you expect them to work in such
embedded situations.
Enabling this implicitly enables :data:`SESSION_COOKIE_SECURE` as well, as
it is only valid when served over HTTPS.
Default: ``False``
.. versionadded:: 3.1
.. py:data:: SESSION_COOKIE_SAMESITE
Restrict how cookies are sent with requests from external sites. Can