gh-136992: Add 'None' as valid SameSite value as per RFC6265bis by iqra-codes · Pull Request #137040 · python/cpython

iqra-codes · 2025-07-23T12:16:16Z

This PR adds missing documentation for the samesite attribute in the http.cookies module.

While the attribute was already listed among valid Morsel attributes, it lacked an explanation. This change adds clear and complete documentation explaining:

-The attribute’s role in CSRF protection.

-The valid values: "Strict", "Lax", and "None".

-The requirement that "secure" must be set when using "SameSite=None".

This update brings the documentation in line with RFC6265bis and reflects current browser behaviour.

📚 Documentation preview 📚: https://cpython-previews--137040.org.readthedocs.build/

Issue: http.cookies should mention that samesite=None is valid as per RFC6265bis #136992

python-cla-bot · 2025-07-23T12:16:21Z

All commit authors signed the Contributor License Agreement.

ZeroIntensity

The change looks good to me, but please run pre-commit to fix the failing lint job.

ZeroIntensity

LGTM.

For future reference, you don't need to force push; we squash at the end.

iqra-codes · 2025-07-24T06:44:02Z

Thanks for the heads-up! I’ll avoid force-pushing next time.

Doc/library/http.cookies.rst

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

Doc/library/http.cookies.rst

picnixz · 2025-07-27T07:43:31Z

Now, don't touch your branch at all. No need to update it either.

miss-islington-app · 2025-07-27T08:27:12Z

Thanks @iqra-codes for the PR, and @picnixz for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14.
🐍🍒⛏🤖

…bis (pythonGH-137040) The "SameSite" attribute defined in RFC 6265bis [1] allows the "Strict", "Lax" and "None" enforcement modes. We already documented "Strict" and "Lax" as being valid values but "None" was missing from the list. While the RFC has not been formally approved, modern browsers support the "None" value [2, 3] thereby making sense to document it. [1]: https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis [2]: https://developers.google.com/search/blog/2020/01/get-ready-for-new-samesitenone-secure [3]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#none --------- (cherry picked from commit ae8b7d7) Co-authored-by: Iqra Khan <iqraakhan2519@gmail.com> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

picnixz · 2025-07-27T08:27:17Z

Thank you for the contribution!

…bis (pythonGH-137040) The "SameSite" attribute defined in RFC 6265bis [1] allows the "Strict", "Lax" and "None" enforcement modes. We already documented "Strict" and "Lax" as being valid values but "None" was missing from the list. While the RFC has not been formally approved, modern browsers support the "None" value [2, 3] thereby making sense to document it. [1]: https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis [2]: https://developers.google.com/search/blog/2020/01/get-ready-for-new-samesitenone-secure [3]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#none --------- (cherry picked from commit ae8b7d7) Co-authored-by: Iqra Khan <iqraakhan2519@gmail.com> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

bedevere-app · 2025-07-27T08:27:22Z

GH-137140 is a backport of this pull request to the 3.14 branch.

bedevere-app · 2025-07-27T08:27:28Z

GH-137141 is a backport of this pull request to the 3.13 branch.

…5bis (GH-137040) (#137141) gh-136992: Add "None" as valid `SameSite` value as per RFC 6265bis (GH-137040) The "SameSite" attribute defined in RFC 6265bis [1] allows the "Strict", "Lax" and "None" enforcement modes. We already documented "Strict" and "Lax" as being valid values but "None" was missing from the list. While the RFC has not been formally approved, modern browsers support the "None" value [2, 3] thereby making sense to document it. [1]: https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis [2]: https://developers.google.com/search/blog/2020/01/get-ready-for-new-samesitenone-secure [3]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#none --------- (cherry picked from commit ae8b7d7) Co-authored-by: Iqra Khan <iqraakhan2519@gmail.com> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

iqra-codes · 2025-07-28T13:11:57Z

Thank you! Happy to contribute ..!

…5bis (GH-137040) (#137140) Co-authored-by: Iqra Khan <iqraakhan2519@gmail.com> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

…bis (python#137040) The "SameSite" attribute defined in RFC 6265bis [1] allows the "Strict", "Lax" and "None" enforcement modes. We already documented "Strict" and "Lax" as being valid values but "None" was missing from the list. While the RFC has not been formally approved, modern browsers support the "None" value [2, 3] thereby making sense to document it. [1]: https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis [2]: https://developers.google.com/search/blog/2020/01/get-ready-for-new-samesitenone-secure [3]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#none --------- Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

…FC 6265bis (pythonGH-137040) (python#137140) Co-authored-by: Iqra Khan <iqraakhan2519@gmail.com> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

bedevere-app bot added awaiting review docs Documentation in the Doc dir skip news labels Jul 23, 2025

github-project-automation bot added this to Docs PRs Jul 23, 2025

github-project-automation bot moved this to Todo in Docs PRs Jul 23, 2025

brianschubert changed the title ~~Doc: Add 'None' as valid SameSite value as per RFC6265bis~~ gh-136992: Add 'None' as valid SameSite value as per RFC6265bis Jul 23, 2025

bedevere-app bot mentioned this pull request Jul 23, 2025

http.cookies should mention that samesite=None is valid as per RFC6265bis #136992

Closed

ZeroIntensity reviewed Jul 23, 2025

View reviewed changes

Doc: Add 'None' as valid SameSite value as per RFC6265bis

034648c

iqra-codes force-pushed the main branch from 6ed0195 to 034648c Compare July 23, 2025 18:04

ZeroIntensity added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Jul 23, 2025

ZeroIntensity approved these changes Jul 24, 2025

View reviewed changes

bedevere-app bot added awaiting merge and removed awaiting review labels Jul 24, 2025

ZeroIntensity reviewed Jul 24, 2025

View reviewed changes

Doc/library/http.cookies.rst Outdated Show resolved Hide resolved

Doc: Remove reference to RFC6265bis from SameSite=None note

5fa67f1

picnixz reviewed Jul 25, 2025

View reviewed changes

Doc/library/http.cookies.rst Outdated Show resolved Hide resolved

picnixz reviewed Jul 25, 2025

View reviewed changes

Doc/library/http.cookies.rst Outdated Show resolved Hide resolved

iqra-codes and others added 2 commits July 27, 2025 00:08

Update Doc/library/http.cookies.rst

19ee8cc

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

Doc: Update SameSite description to follow RFC wording

5d8ca29

picnixz reviewed Jul 26, 2025

View reviewed changes

Doc/library/http.cookies.rst Show resolved Hide resolved

picnixz reviewed Jul 26, 2025

View reviewed changes

Doc/library/http.cookies.rst Show resolved Hide resolved

picnixz reviewed Jul 26, 2025

View reviewed changes

Doc/library/http.cookies.rst Show resolved Hide resolved

Doc: Ensure exactly one blank line after SameSite paragraph

b2efceb

picnixz reviewed Jul 26, 2025

View reviewed changes

Doc/library/http.cookies.rst Outdated Show resolved Hide resolved

iqra-codes added 2 commits July 27, 2025 13:08

Doc: Remove extra whitespace from blank line after partitioned paragraph

ccbcdd3

Doc: Remove extra whitespace from blank line after partitioned paragraph

edb3a7f

picnixz approved these changes Jul 27, 2025

View reviewed changes

picnixz merged commit ae8b7d7 into python:main Jul 27, 2025
25 checks passed

github-project-automation bot moved this from Todo to Done in Docs PRs Jul 27, 2025

bedevere-app bot removed the awaiting merge label Jul 27, 2025

bedevere-app bot removed the needs backport to 3.14 bugs and security fixes label Jul 27, 2025

bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Jul 27, 2025

Uh oh!

Conversation

iqra-codes commented Jul 23, 2025 • edited by bedevere-app bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

python-cla-bot bot commented Jul 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ZeroIntensity left a comment

Choose a reason for hiding this comment

Uh oh!

ZeroIntensity left a comment

Choose a reason for hiding this comment

Uh oh!

iqra-codes commented Jul 24, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

picnixz commented Jul 27, 2025

Uh oh!

Uh oh!

miss-islington-app bot commented Jul 27, 2025

Uh oh!

picnixz commented Jul 27, 2025

Uh oh!

bedevere-app bot commented Jul 27, 2025

Uh oh!

bedevere-app bot commented Jul 27, 2025

Uh oh!

iqra-codes commented Jul 28, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

iqra-codes commented Jul 23, 2025 •

edited by bedevere-app bot

Loading

python-cla-bot bot commented Jul 23, 2025 •

edited

Loading