[GitHub] [superset] trepmag commented on issue #8382: Error `The CSRF session token is missing` when embed superset in iframe

[GitBox <gi...@apache.org>]

trepmag commented on issue #8382:
URL: https://github.com/apache/superset/issues/8382#issuecomment-764509284


   This issue produce quiet some confusion because browsers behaviors aren't aligned...
   
   Actually, what I noticed is the following:
   ```
   SESSION_COOKIE_SAMESITE = "None" # Sufficient for Firefox
   SESSION_COOKIE_SECURE = True # Required for Google Chrome (at least from version 84)
   ```
   
   This above setup is stated is a [IETF proposal: Incrementally Better Cookies](https://tools.ietf.org/html/draft-west-cookie-incrementalism-00) and was ported to my attention in this article: [Cookies and Iframes](https://medium.com/trabe/cookies-and-iframes-f7cca58b3b9e).
   
   More over, note that it appears that Google Chrome in incognito mode will fail!...
   


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org