Flask cookies do not have the SameSite attribute

Question

Recently due to Chrome 80, it has been noted that cookies without the SameSite=None and Secure attributes will not get set in Chrome browsers.

Currently, I use the Flask-JWT-Extended library to generate my cookies for my backend, but even though it has the samesite=None in the set_cookies function the cookies still do not get set in the browser. I sent the request with Postman and viewed my cookie and got the below cookie:

access_token_cookie=my_token; Path=/; Domain=127.0.0.1; Secure; HttpOnly;

I have tried manually setting the headers with:

resp.headers.add('Set-Cookie', 'access_token_cookie=bar; SameSite=None; Secure')

But even after setting the cookie manually, I still get the following cookie with no SameSite attribute:

access_token_cookie=bar; Path=/user; Domain=127.0.0.1; Secure;

I'm wondering if there is a way to set the SameSite attribute within the cookies right now.

Edit This is the code that I have for the site.

• List item

        access_token = create_access_token(identity=user.username)
        resp = jsonify({"username": user.username,
                        "user_type": user.roles
                        })
        resp.headers.add('Set-Cookie', 'access_token_cookie=' + access_token + '; SameSite=None; Secure')
        return resp

Answer 1

Chrome ignores cookies marked as Secure that was received via insecure channel. So, you can either test this via https or remove the Secure attribute