title: Django doesn't create session cookie in cross-site json request
body: <p>I want to make cross-site JavaScript call from third-party domain (in this case my desktop/localhost server) to my remote Django server hosted on my_domain.com/ and calling REST WS exposed on my_domain.com/msg/my_service with using session/cookies for storing session state.</p>
  <p>But when I call this service (hosted on remote Django server) from my desktop browser or localhost Django server (JS is in index.html), Django doesn't create session cookie and on remote server are doesn't store session state. But when i call this service from Postman or from same localhost JS to localhost instance of same Django service it works and session is created.</p>
  <p>My JS script in index.html which make call to WS send_message:</p>
  <pre><code>                fetch('http://my_domain.com/ws/my_service', {
                              method:&quot;POST&quot;,
                                  credentials: 'include',
                              body:JSON.stringify(data)
                              })
                              .then(res =&gt; res.json())
                              .then(json =&gt; {
                                              showResponse(json.message);
                              })
  </code></pre>
  <p>When I run this script from my desktop browser or my localhost server it runs correctly with cookies and sessions parameters.</p>
  <p>Django my_service implementation view</p>
  <pre><code>@csrf_exempt
  def my_service(request):
      if request.method == &quot;POST&quot;:
  
          message_bstream= request.body
      
          request.session.set_expiry(0)
          
          message= json.loads(message_bstream)
      
          out,sta=state_machine_response(message[&quot;message&quot;],int(request.session[&quot;state&quot;]))
       
          request.session[&quot;state&quot;] =sta
          respo={&quot;message&quot;:out}
      
          response = HttpResponse(json.dumps(respo), content_type=&quot;application/json&quot;)
          response.set_cookie(key='name', value='my_value', samesite='None', secure=True)
          #return JsonResponse(respo, safe=False, status=200)
          return response
      else:
          return HttpResponseNotFound (&quot;Sorry this methode is not allowed&quot;)
  </code></pre>
  <p>Or I try generate response like</p>
  <pre><code>return JsonResponse(respo, safe=False, status=200)
  </code></pre>
  <p>My settings.py</p>
  <pre><code>    INSTALLED_APPS = [
    ...
      'corsheaders',
  ]
  
  CORS_ALLOW_CREDENTIALS = True
  CORS_ORIGIN_WHITELIST = (
      'http://localhost:8000', 
  )
  
   CORS_ALLOWED_ORIGINS = [
      'http://localhost:8000',
  ]
  
  CSRF_TRUSTED_ORIGINS = [
      'http://localhost:8000',
  ]
  
  MIDDLEWARE = [
      'corsheaders.middleware.CorsMiddleware',
      'django.middleware.security.SecurityMiddleware',
      'django.middleware.common.CommonMiddleware',
      'django.contrib.sessions.middleware.SessionMiddleware',
      'django.middleware.csrf.CsrfViewMiddleware',
      'django.contrib.auth.middleware.AuthenticationMiddleware',
      'django.contrib.messages.middleware.MessageMiddleware',
      'django.middleware.clickjacking.XFrameOptionsMiddleware',
  ]
  
  CSRF_COOKIE_SECURE = True
  CSRF_COOKIE_SAMESITE = 'None'
  SESSION_COOKIE_SAMESITE = 'None'
  </code></pre>
  <p>Please do you have any idea?</p>