Django doesn't create session cookie in cross-site json request

Question

I want to make cross-site JavaScript call from third-party domain (in this case my desktop/localhost server) to my remote Django server hosted on my_domain.com/ and calling REST WS exposed on my_domain.com/msg/my_service with using session/cookies for storing session state.

But when I call this service (hosted on remote Django server) from my desktop browser or localhost Django server (JS is in index.html), Django doesn't create session cookie and on remote server are doesn't store session state. But when i call this service from Postman or from same localhost JS to localhost instance of same Django service it works and session is created.

My JS script in index.html which make call to WS send_message:

                fetch('http://my_domain.com/ws/my_service', {
                            method:"POST",
                                credentials: 'include',
                            body:JSON.stringify(data)
                            })
                            .then(res => res.json())
                            .then(json => {
                                            showResponse(json.message);
                            })

When I run this script from my desktop browser or my localhost server it runs correctly with cookies and sessions parameters.

Django my_service implementation view

@csrf_exempt
def my_service(request):
    if request.method == "POST":

        message_bstream= request.body
    
        request.session.set_expiry(0)
        
        message= json.loads(message_bstream)
    
        out,sta=state_machine_response(message["message"],int(request.session["state"]))
     
        request.session["state"] =sta
        respo={"message":out}
    
        response = HttpResponse(json.dumps(respo), content_type="application/json")
        response.set_cookie(key='name', value='my_value', samesite='None', secure=True)
        #return JsonResponse(respo, safe=False, status=200)
        return response
    else:
        return HttpResponseNotFound ("Sorry this methode is not allowed")

Or I try generate response like

return JsonResponse(respo, safe=False, status=200)

My settings.py

    INSTALLED_APPS = [
  ...
    'corsheaders',
]

CORS_ALLOW_CREDENTIALS = True
CORS_ORIGIN_WHITELIST = (
    'http://localhost:8000', 
)

 CORS_ALLOWED_ORIGINS = [
    'http://localhost:8000',
]

CSRF_TRUSTED_ORIGINS = [
    'http://localhost:8000',
]

MIDDLEWARE = [
    'corsheaders.middleware.CorsMiddleware',
    'django.middleware.security.SecurityMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

CSRF_COOKIE_SECURE = True
CSRF_COOKIE_SAMESITE = 'None'
SESSION_COOKIE_SAMESITE = 'None'

Please do you have any idea?

Answer 1

You can't save cookies from a third-party API call unless you use SameSite=None with the Secure option in the Set-Cookie header. You can achieve this for the sessionid and CSRF cookie with the following settings:

CSRF_COOKIE_SECURE = True
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SAMESITE = 'None'
SESSION_COOKIE_SAMESITE = 'None'

In this case, you must use the HTTPS protocol scheme.

Another solution would be to use a proxy, which is helpful in a localhost development environment. This is an example using vue.js on the vue.config.js file:

const { defineConfig } = require('@vue/cli-service')

if (process.env.NODE_ENV == "development"){
  module.exports = defineConfig({
    transpileDependencies: true,
    devServer: {
      proxy: {
        "^/api/": {
          target: process.env.VUE_APP_BASE_URL,
          changeOrigin: true,
          logLevel: "debug",
          pathRewrite: { "^/api": "/api" }
        }
      }
    },
  })
}

Some useful doc https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite#samesitenone_requires_secure