Skip to content

Bug: Cookie with SameSite.DEFAULT_MODE sends an empty SameSite= attribute #8708

Open

Description

@anishmehta24

Expected Behaviour

Cookie(..., same_site=SameSite.DEFAULT_MODE) leaves the SameSite attribute out of the Set-Cookie header, so the browser applies its default (the same as Go's http.SameSiteDefaultMode, which these names follow).

Current Behaviour

Cookie.__str__ checks if self.same_site:, which is true for every enum member, and DEFAULT_MODE has the value "", so the header gets an attribute with no value: SameSite=. That is not a valid SameSite value.

Code snippet

from aws_lambda_powertools.shared.cookies import Cookie, SameSite

str(Cookie(name="session", value="abc", same_site=SameSite.DEFAULT_MODE))
# 'session=abc; Secure; SameSite='

Steps to Reproduce

  1. Create a Cookie with same_site=SameSite.DEFAULT_MODE.
  2. Return it in a Response(cookies=[...]) or call str() on it.
  3. The Set-Cookie value ends with SameSite=.

Possible Solution

Only write the attribute when the enum value is not empty. I can open a PR.

Powertools for AWS Lambda (Python) version

latest (develop, 3.38.0)

AWS Lambda function runtime

3.12

Packaging format used

PyPi

Debugging logs

No response

Activity

  1. leandrodamascena commented on Oct 30, 2026

    @leandrodamascena
    Contributor

    Thanks @anishmehta24, confirmed, SameSite= with nothing after it. Reviewing #8709. Goes into 3.40.0.

  2. added this to the 3.40.0 milestone on Oct 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

Relationships

None yet

Development

No branches or pull requests

Issue actions