Issue 1:
Expected Behavior

I should be able to set SESSION_COOKIE_SAMESITE to "None" in order to explicitly set SameSite=None on my session cookie.

This will allow my flask application to be loaded in an iframe with the session.

app.config['SESSION_COOKIE_SAMESITE'] = "None"

Actual Behavior

Today I can only set SESSION_COOKIE_SAMESITE to "Strict", "Lax", or None.

If set to None, it will actually not set a SameSite attribute at all on the session cookie, which Chrome will treat as SameSite=Lax starting in Chrome 80.

I need to be able to set SESSION_COOKIE_SAMESITE to explicitly "None", thus causing SameSite=None to be set on the cookie, which in turn allows the cookie to be sent in cross-origin requests, such as when my flask application is loaded in an iframe.

As it is, these applications load in an iframe without a session cookie, which breaks their functionality.

Environment

Python version: 3.7.4

Flask version: 1.1.1

Werkzeug version: 0.16.0

Note related Werkzeug issue which is tied up with the 1.0 release: pallets/werkzeug#1549

2020-01-14T20:33:48.807523+00:00 app[web.1]: Traceback (most recent call last):
2020-01-14T20:33:48.807525+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.7/site-packages/gunicorn/workers/sync.py", line 135, in handle
2020-01-14T20:33:48.807528+00:00 app[web.1]: self.handle_request(listener, req, client, addr)
2020-01-14T20:33:48.807530+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.7/site-packages/gunicorn/workers/sync.py", line 176, in handle_request
2020-01-14T20:33:48.807534+00:00 app[web.1]: respiter = self.wsgi(environ, resp.start_response)
2020-01-14T20:33:48.807536+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.7/site-packages/flask/app.py", line 2463, in __call__
2020-01-14T20:33:48.807538+00:00 app[web.1]: return self.wsgi_app(environ, start_response)
2020-01-14T20:33:48.807540+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.7/site-packages/flask/app.py", line 2449, in wsgi_app
2020-01-14T20:33:48.807542+00:00 app[web.1]: response = self.handle_exception(e)
2020-01-14T20:33:48.807544+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.7/site-packages/flask/app.py", line 1866, in handle_exception
2020-01-14T20:33:48.807546+00:00 app[web.1]: reraise(exc_type, exc_value, tb)
2020-01-14T20:33:48.807548+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.7/site-packages/flask/_compat.py", line 39, in reraise
2020-01-14T20:33:48.807549+00:00 app[web.1]: raise value
2020-01-14T20:33:48.807551+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.7/site-packages/flask/app.py", line 2446, in wsgi_app
2020-01-14T20:33:48.807553+00:00 app[web.1]: response = self.full_dispatch_request()
2020-01-14T20:33:48.807554+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.7/site-packages/flask/app.py", line 1952, in full_dispatch_request
2020-01-14T20:33:48.807556+00:00 app[web.1]: return self.finalize_request(rv)
2020-01-14T20:33:48.807557+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.7/site-packages/flask/app.py", line 1969, in finalize_request
2020-01-14T20:33:48.807559+00:00 app[web.1]: response = self.process_response(response)
2020-01-14T20:33:48.807560+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.7/site-packages/flask/app.py", line 2268, in process_response
2020-01-14T20:33:48.807562+00:00 app[web.1]: self.session_interface.save_session(self, ctx.session, response)
2020-01-14T20:33:48.807563+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.7/site-packages/flask/sessions.py", line 387, in save_session
2020-01-14T20:33:48.807565+00:00 app[web.1]: samesite=samesite,
2020-01-14T20:33:48.807567+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.7/site-packages/werkzeug/wrappers/base_response.py", line 481, in set_cookie
2020-01-14T20:33:48.807568+00:00 app[web.1]: samesite=samesite,
2020-01-14T20:33:48.807570+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.7/site-packages/werkzeug/http.py", line 1161, in dump_cookie
2020-01-14T20:33:48.807571+00:00 app[web.1]: raise ValueError("invalid SameSite value; must be 'Strict', 'Lax' or None")
2020-01-14T20:33:48.807573+00:00 app[web.1]: ValueError: invalid SameSite value; must be 'Strict', 'Lax' or None```

Issue 2:
Google's recent blog post describes changes on how they will enforce Cookies with SameSite value. The referenced samesite cookies explained article and RFC both describe the ability to specify a SameSite value of 'None' the string (as opposed to None, not set) for SameSite.

The following today produces an error stating invalid SameSite value; must be 'Strict', 'Lax' or None

resp.set_cookie('somekey', 'someval', domain='.mydomain.com', samesite='None')

You would think setting None would work but instead it unsets the key and prevents the samesite attribute from being present with a None (string) value in the headers.

resp.set_cookie('somekey', 'someval', domain='.mydomain.com', samesite=None)