djangosessionincognito-mode

Django session doesn't work in Chrome Incognito mode


I have 3 views like this:

def download_file(request, doc):
    if not request.session.get('is_authenticated'):
        return redirect(f"{reverse('pingfed_auth')}?next={request.get_full_path()}")
    return downloadfile(doc)

def pingfed_auth(request):
    original_url = request.GET.get('next') or 'home'
    request.session['original_url'] = original_url
    return redirect('Some third party authentication')

def redirect_pingfed_auth(request):
    if request.method == 'POST':
        request.session['is_authenticated'] = True
        request.session['username'] = get_username_from_saml(request.POST.get('SAMLResponse'))
        return redirect(request.session['original_url'] if 'original_url' in request.session else 'home') 

Where pingfed_auth start the authentication and redirect_pingfed_auth is the callback URL from that thrid-party authentication. However, the session doesn't work in chrome Incognito mode. I can't see any session from browser console, and I can't get redirect correctly. But I do see the session is stored properly in the database. Is that because Incognito mode block the session after redirect to third party site or something else?


Solution

  • enter image description here

    In incognito mode it blocks third-party cookies if your authentication flow relies on cookies that are considered "third-party" that is - ( cookies set by domains other than your own during the authentication process), these cookies may be blocked. This can result in the session not being recognized after the redirect back from the third-party authentication provider.