Package: samesite-compat-check
samesite-compat-checkThis is a Python port of theChromium project's browser compatibility checkforSameSite=None-cookies.samesite-compat-check exposes a single functionshould_send_same_site_nonewhich takes aUser-Agentstring and returnsTrueifSameSite=Noneis
supported by the browser with the givenUser-AgentandFalseif not.IfUser-AgentisNonethenshould_send_same_site_nonereturnsTrue.This is the only addition on top of the pseudocode from the Chromium projectThe reason for this added behavior is to handle the case where theUser-Agent-header is not sent. The logic is that only  browsers that
specifically mishandleSameSite=Noneshould have the attribute omitted. You
can safely sendSameSite=None-attribute to a browser that doesn't recognize
the attribute (e.g. an older browser). As in that caseSameSitewill be
ignored, and you'll automatically get the behavior you intended, as cookies
before theSameSite-attibute were introduced worked as similar toSameSite=None.SameSite cookiesYou probably already know whatSameSite-cookies are -- if not, I recommend you
readhttps://web.dev/samesite-cookies-explained/at the very least.SameSite=None-cookies are mostly relevant to people who needs cookies on CORS
requests or need cookies inside an iframe. So if you don't use cookies when
doing CORS or in iframes (or useSameSite=Nonefor some other reason) you
can safely ignore this package.You may say -- who uses iframes nowadays? Well, plenty of things do!
Youtube Embeds, the Intercom widget, that new little "Log in with Google"
popover on sites like Medium.Well, if you're one those people who needSameSite=None, you'll find that a
good portion of your users have browsers that are incompatible withSameSitecookies that have the valueNone.That's where this library comes in. It checks theUser-Agentstring, and returns
whether it is from a browser that is incompatible.Recommendation is to just not useSameSitefor those browsers. Since the
browsers are "old" and don't enforce theSameSite-rules for cookies where
the flag is not present, they will have the right behavior when you don't sendSameSite=None.You'll need to pass in the value of theUser-Agent-header from the library
you're using (Django, Flask...) and then either set or not setSameSite=Noneon the cookie.UsageGeneral use:fromsamesite_compat_checkimportshould_send_same_site_noneifshould_send_same_site_none(user_agent):# Set cookie with `SameSite=None`else:# Set cookie without any `SameSite` attributeDjangoifshould_send_same_site_none(request.META['HTTP_USER_AGENT']):response.cookies['my_precious_cookie']['samesite']='None'else:passSettingresponse.set_cookie(..., samesite='none')will be allowed from
Django 3.1 and onwards. Currently onlylaxandstrictare allowed inresponse.set_cookie(). Django only allows lowercase values forsamesite.
Accoring to the spec lowercase/uppercase should not matter, however I have not
tested that particular detail in a browser.Flaskfromflaskimportrequestkwargs={}ifshould_send_same_site_none(request.headers.get('User-Agent')):kwargs['samesite']='None'# Requires Werkzeug>=1.0.0 (a Flask dependency) in order to use `samesite`response.set_cookie('my_precious_cookie',value='123abc',secure=True,**kwargs)Requirementssamesite-compat-checkhas no dependencies and is tested on
Python 2.7, 3.4, 3.5, 3.6, 3.7, 3.8, and PyPy 3.Installationpip install samesite-compat-checkUseful referenceshttps://github.com/jotes/django-cookies-samesiteThis package serves as a good example of implementing the SameSite cookie in Django.However, only checks for Chrome/Chromium version 51-66, not iOS, macOS, and UC Browser.
Howeverhttps://github.com/GoogleChromeLabs/samesite-examplesThis repo has examples for setting a cookie with the SameSite-attribute in Python and in Flask,
but does not implement any of the browser incompatibility checks.https://github.com/linsight/should-send-same-site-noneA Javascript package similar to this one.https://itnext.io/user-agent-sniffing-only-way-to-deal-with-upcoming-samesite-cookie-changes-6f79a18e541An alternative implementation in Javascript that isn't based off the Chromium project pseudocode.Authorssamesite-compat-checkwas written byMalthe Jørgensen <malthe.jorgensen@gmail.com>at Peergrade Inc.,
and is a port of Chromium's pseudocode for checking browsers incompatible withSameSite=Nonecookies
which can be found here:https://www.chromium.org/updates/same-site/incompatible-clientsThat pseudocode is Copyright 2019 Google LLC. and released under the Apache 2.0
license.The tests use a sample of User-Agent strings fromhttps://developers.whatismybrowser.com/useragents/.