Add SameSite support for cookies

[hyde0620]

It would be great if we can set "SameSite" flag via set_cookie function.

e.g.
response.set_cookie(cookie_key, cookie_id, same-site-cookies='Lax', ....)

[provinzkraut]

For a workaround, you could just add it via add_header() like this:
response.add_header('Set-Cookie', 'cookie_key=cookie_id; SameSite=Lax').

But indeed it would be nice to have this as a keyword for set_cookie().

I looked at the code and he http.cookie module (wich handles the cookies in bottle) doesn't support the "SameSite" attribute.
There's an open pull request to support "SameSite" in http.cookie in python 3.7.

However, if you want to do this via set_cookie() you could modify your bottle.py like this:

import Morsel from http.cookies: from http.cookies import Morsel.
Then add the following to set_cookie():
Morsel._reserved['same-site'] = 'SameSite'.

Now you can use the attribute same_site in set.cookie(), like
response.set_cookie(cookie_key, cookie_id same_site="lax").

This updates the _reserved dict, which is used to check if an attribute is valid.

[hyde0620]

@provinzkraut Thanks for the reply.
It's a good way to add the attribute same_site. 👍

[oz123]

@defnull this issue is resolved.

[Teva]

Hi all,

I am wondering if my issue is linked to this closed issue :

 response.set_cookie(name = "name", value = name, secret='some-secret-key', httponly = True, same_site = 'strict')  #secure = True to be added in prod

this raises the following error with python 3.7 :
MYPATH--> /http/cookies.py", line 311, in setitem
raise CookieError("Invalid attribute %r" % (K,))
http.cookies.CookieError: Invalid attribute 'same-site'

[susundberg]

I ended up hitting the excatly the same error message with bottle 0.12.18 (Python 3.6.9)

Traceback (most recent call last):
  File "FOOPATH/bottle/bottle.py", line 868, in _handle
    return route.call(**args)
  File "FOOPATH/bottle/bottle.py", line 1748, in wrapper
    rv = callback(*a, **ka)
  File "hackforum/main.py", line 50, in login_post
  File "FOOPATH/bottle/bottle.py", line 1649, in set_cookie
    self._cookies[name][key.replace('_', '-')] = value
  File "/usr/lib/python3.6/http/cookies.py", line 332, in __setitem__
    raise CookieError("Invalid attribute %r" % (K,))
http.cookies.CookieError: Invalid attribute 'same-site'

[defnull]

The fix (or same-site support) was not back-ported to 0.12 yet.