Can't login to admin panel with Chrome (but it works with Firefox)

Site Operators Site Operations Help
1

Hi,

since August, it is no longer possible to log-in to admin panel using Chrome (although it is working perfectly in Firefox). According to my tests, it is due to the new SameSite cookie policy enforcement in Google Chrome. More specifically, Chrome is not accepting the csrftoken sent by Django Admin panel due to the lack of the Secure tag in the cookie:

image
image1244×652 127 KB

In order to allow to log-in to Django Admin panel using Chrome, I think that this cookie header:

Set-Cookie: csrftoken=eneVM9tVfoCvgsfxYRDWmaw0YuCHWnSMgJqlclbXVWRDpO4vSgtFOZAnJK9cPP6r; expires=Mon, 30 Aug 2021 08:46:54 GMT; Max-Age=31449600; Path=/; SameSite=None

Should be:
Set-Cookie: csrftoken=eneVM9tVfoCvgsfxYRDWmaw0YuCHWnSMgJqlclbXVWRDpO4vSgtFOZAnJK9cPP6r; expires=Mon, 30 Aug 2021 08:46:54 GMT; Max-Age=31449600; Path=/; SameSite=None; Secure

(look at the last “; Secure” part)

How can we change Django settings to allow that?

Thanks.

2

Hi,

I temporarily use to change the variable None to Lax, on DCS_SESSION_COOKIE_SAMESITE

Located in edx-platform / lms / envs / common.py

restart lms and login again.

1 Like