implement SameSite cookie attribute

README.rst

@@ -233,6 +233,9 @@ The follow options applies to the cookie-based authentication policy:
 | https_only     | jwt.https_only_cookie     | True          | Whether or not the token should only be    |
 |                |                           |               | sent through a secure HTTPS transport      |
 +----------------+---------------------------+---------------+--------------------------------------------+
+| samesite       | jwt.samesite              | one           | Set the 'SameSite' attribute of the cookie |
+|                |                           |               | can be 'strict', 'lax', 'none'             |
++----------------+---------------------------+---------------+--------------------------------------------+
 | reissue_time   | jwt.cookie_reissue_time   |  None         | Number of seconds (or a datetime.timedelta |
 |                |                           |               | instance) before a cookie (and the token   |
 |                |                           |               | within it) is reissued                     |

src/pyramid_jwt/__init__.py

@@ -94,6 +94,7 @@ def set_jwt_cookie_authentication_policy(
     audience=None,
     cookie_name=None,
     https_only=True,
+    samesite=None,
     reissue_time=None,
     cookie_path=None,
 ):
@@ -103,6 +104,8 @@ def set_jwt_cookie_authentication_policy(
     reissue_time = reissue_time or settings.get("jwt.cookie_reissue_time")
     if https_only is None:
         https_only = settings.get("jwt.https_only_cookie", True)
+    if samesite is None:
+        samesite = settings.get("jwt.samesite", None)
 
     auth_policy = create_jwt_authentication_policy(
         config,
@@ -123,6 +126,7 @@ def set_jwt_cookie_authentication_policy(
         cookie_name=cookie_name,
         https_only=https_only,
         reissue_time=reissue_time,
+        samesite=samesite,
         cookie_path=cookie_path,
     )
 

src/pyramid_jwt/policy.py

@@ -170,6 +170,7 @@ def __init__(
         audience=None,
         cookie_name=None,
         https_only=True,
+        samesite=None,
         reissue_time=None,
         cookie_path=None,
     ):
@@ -188,6 +189,7 @@ def __init__(
         )
 
         self.https_only = https_only
+        self.samesite = samesite
         self.cookie_name = cookie_name or "Authorization"
         self.max_age = self.expiration and self.expiration.total_seconds()
 
@@ -198,6 +200,7 @@ def __init__(
         self.cookie_profile = CookieProfile(
             cookie_name=self.cookie_name,
             secure=self.https_only,
+            samesite=self.samesite,
             max_age=self.max_age,
             httponly=True,
             path=cookie_path,