You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Bug: Cookie with SameSite.DEFAULT_MODE sends an empty SameSite= attribute #8708
Cookie(..., same_site=SameSite.DEFAULT_MODE) leaves the SameSite attribute out of the Set-Cookie header, so the browser applies its default (the same as Go's http.SameSiteDefaultMode, which these names follow).
Current Behaviour
Cookie.__str__ checks if self.same_site:, which is true for every enum member, and DEFAULT_MODE has the value "", so the header gets an attribute with no value: SameSite=. That is not a valid SameSite value.
Activity
leandrodamascena commentedon Oct 30, 2026
Thanks @anishmehta24, confirmed,
SameSite=with nothing after it. Reviewing #8709. Goes into 3.40.0.