Can't login: invalid setting for "sessionid" cookie. When running LMS in http

[ghassanmas]

When trying to login to LMS using http, Django add cookie named sessionidwith Same-site=None as show below:

sessionid=1|token; Domain=edx.mydomain.io; expires=Mon, 29 Nov 2021 12:16:23 GMT; HttpOnly; Max-Age=1209600; Path=/; SameSite=None

However, the cookie will be rejected because according to this ref (which is required according to ref[1]) It's understandable why Django hasn't added Secure since the connection isn't using https, however, the best procedure might be to change the cookie middleware[2] such as it doesn't make SameSite=None if the connection isn't secured i.e using HTTP.

I have resolved this issue for me, by enabling https on caddy( I am using tutor, so I sat ENABLE_HTTPS: true in config.yml). But it didn't work if/when the https is being handled by the host machine, but then that would an issue related to tutor at this point.

So in summary we might need to change the cookie middleware [2], such that it doesn't use SameSite=None if the connection is not secured.

Ref:

• [1] samesite-cookies
• [2] Cookie middleware

[regisb]

I have resolved this issue for me, by enabling https on caddy( I am using tutor, so I sat ENABLE_HTTPS: true in config.yml). But it didn't work if/when the https is being handled by the host machine, but then that would an issue related to tutor at this point.

@ghassanmas are you saying that the issue only occurs when you are running an http proxy on the host? If yes, what is its configuration?

[ghassanmas]

The problem occuard on both when host machine is handelding encryption layer or if caddy container is being exposed on 80 when is exactly thet confgiration below

Base configuraiton.

Wasn't changed during debugging, e.g. think those config will be merged with each one, to represent the the state of config.yml

LMS_HOST: example.com
RUN_FORUM: false
RUN_SMTP: false
SMTP_HOST: smtp.gmail.com
SMTP_PORT: 587
SMTP_USERNAME: [email protected]
SMTP_USE_TLS: true

When caddy on is exposed with http ❌

ENABLE_HTTPS: false
CADDY_HTTP_PORT: 80

When host is handeling https ❌

ENABLE_HTTPS: <false or true don't rememeber what it was, need to repordiuce>
CADDY_HTTP_PORT:< random port proxy to host machine i.e. 181111/>

confguration when it works with https ✅

ENABLE_HTTPS: true
CADDY_HTTP_PORT:80

[regisb]

This should now be closed in the maple branch of Tutor.