# Session settings with Django's authentication system: possible improvements in documentation and checks

**URL:** <https://forum.djangoproject.com/t/session-settings-with-djangos-authentication-system-possible-improvements-in-documentation-and-checks/730>\
**Category:** Django Internals\
**Created:** [December 29, 2019, 3:46pm UTC](https://forum.djangoproject.com/t/session-settings-with-djangos-authentication-system-possible-improvements-in-documentation-and-checks/730 "2019-12-29T15:46:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![LordGordonQ](https://avatars.discourse-cdn.com/v4/letter/l/53a042/32.png) [@LordGordonQ](https://forum.djangoproject.com/u/LordGordonQ)\
**Post date:** [December 29, 2019, 3:46pm UTC](https://forum.djangoproject.com/t/session-settings-with-djangos-authentication-system-possible-improvements-in-documentation-and-checks/730/1 "2019-12-29T15:46:00Z")

</div>

Hi there,

In one of my Django projects I’m using the provided authentication. I recently had a lot of troubles with the password reset link. The generated link was working fine in the unit tests and when copy-and-paste-ing it from the email; yet clicking the link from the email message resulted in opening the password reset view with the error of invalid token.

It took me a while to find the root cause of this issue: the `SESSION_COOKIE_SAMESITE` setting was set to `Strict`, yet in order to have the password reset link properly working it must be `Lax` (or `None`).

I think this should be made more clear in the documentation ([https://docs.djangoproject.com/en/3.0/topics/auth/default/](https://docs.djangoproject.com/en/3.0/topics/auth/default/)) and possibly a Django check ([https://docs.djangoproject.com/en/3.0/ref/django-admin/#check](https://docs.djangoproject.com/en/3.0/ref/django-admin/#check)) should be added to alert a wrong setting when the authentication links are included in a site.

Should I open a bug report for this?

Thanks

---

<div class="post-metadata">

**Author:** ![adamchainz](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/adamchainz/32/26_2.png) [@adamchainz](https://forum.djangoproject.com/u/adamchainz)\
**Post date:** [December 30, 2019, 9:31am UTC](https://forum.djangoproject.com/t/session-settings-with-djangos-authentication-system-possible-improvements-in-documentation-and-checks/730/2 "2019-12-30T09:31:31Z")

</div>

Yes please do open a trac ticket. I’m in favour of more system checks to catch issues like this.

---

<div class="post-metadata">

**Author:** ![LordGordonQ](https://avatars.discourse-cdn.com/v4/letter/l/53a042/32.png) [@LordGordonQ](https://forum.djangoproject.com/u/LordGordonQ)\
**Post date:** [December 30, 2019, 1:33pm UTC](https://forum.djangoproject.com/t/session-settings-with-djangos-authentication-system-possible-improvements-in-documentation-and-checks/730/3 "2019-12-30T13:33:02Z")

</div>

Done!

[https://code.djangoproject.com/ticket/31129#ticket](https://code.djangoproject.com/ticket/31129#ticket)