Allow cookies from cross site requests to avoid problems with iframes
@@ -13,11 +13,9 @@ class CommunityProxitoSettingsMixin:
USE_SUBDOMAIN = True
SECURE_REFERRER_POLICY = "no-referrer-when-downgrade"
- # Always set to Lax for proxito cookies.
- # Even if the donate app is present.
- # Since we don't want to allow cookies from cross origin requests.
- # This is django's default.
- SESSION_COOKIE_SAMESITE = 'Lax'
+ # Allow cookies from cross-site requests on subdomains for now.
+ # As 'Lax' breaks when the page is embedded in an iframe.
+ SESSION_COOKIE_SAMESITE = None
@property
def DATABASES(self):
