From 775d8a9020f9f9137e2407c9ac2eea2073567b15 Mon Sep 17 00:00:00 2001 From: Anish Mehta Date: Fri, 30 Oct 2026 22:20:10 +0530 Subject: [PATCH] fix(event_handler): leave SameSite out of cookies in DEFAULT_MODE --- aws_lambda_powertools/shared/cookies.py | 3 ++- tests/unit/test_cookie_class.py | 10 ++++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/aws_lambda_powertools/shared/cookies.py b/aws_lambda_powertools/shared/cookies.py index 8b8ea32ab9a..134258c0622 100644 --- a/aws_lambda_powertools/shared/cookies.py +++ b/aws_lambda_powertools/shared/cookies.py @@ -112,7 +112,8 @@ def __str__(self) -> str: if self.secure: payload.write("; Secure") - if self.same_site: + # DEFAULT_MODE leaves the attribute out, so the browser applies its own default + if self.same_site and self.same_site.value: payload.write(f"; SameSite={self.same_site.value}") if self.custom_attributes: diff --git a/tests/unit/test_cookie_class.py b/tests/unit/test_cookie_class.py index 6babb692121..b32010bb9a1 100644 --- a/tests/unit/test_cookie_class.py +++ b/tests/unit/test_cookie_class.py @@ -115,6 +115,16 @@ def test_cookie_with_same_site(): assert str(cookie) == "powertools=test; Path=/; Secure; SameSite=Strict" +def test_cookie_with_same_site_default_mode(): + # GIVEN a cookie with the default same_site mode + cookie = Cookie(name="powertools", value="test", path="/", same_site=SameSite.DEFAULT_MODE) + + # WHEN getting the cookie's attributes + # THEN the SameSite attribute should be left out instead of sent without a value + assert cookie.same_site == SameSite.DEFAULT_MODE + assert str(cookie) == "powertools=test; Path=/; Secure" + + def test_cookie_with_custom_attribute(): # GIVEN a cookie with custom_attributes cookie = Cookie(name="powertools", value="test", path="/", custom_attributes=["extra1=value1", "extra2=value2"])