Add support for partitioned (CHIPS) cookies

docs/options.rst

@@ -44,6 +44,7 @@ Overview:
   * `JWT_COOKIE_DOMAIN`_
   * `JWT_COOKIE_SAMESITE`_
   * `JWT_COOKIE_SECURE`_
+  * `JWT_COOKIE_PARTITIONED`_
   * `JWT_REFRESH_COOKIE_NAME`_
   * `JWT_REFRESH_COOKIE_PATH`_
   * `JWT_SESSION_COOKIE`_
@@ -358,6 +359,18 @@ These are only applicable if a route is configured to accept JWTs via cookies.
 
     Default: ``False``
 
+.. _JWT_COOKIE_PARTITIONED:
+.. py:data:: JWT_COOKIE_PARTITIONED
+
+    Controls if the ``partitioned`` flag should be placed on cookies
+    created by this extension.
+
+    Cookies Having Independent Partitioned State (CHIPS, also known as
+    Partitioned cookies) allows developers to opt a cookie into
+    partitioned storage, with a separate cookie jar per top-level
+    site.
+
+    Default: ``False``
 
 .. _JWT_REFRESH_COOKIE_NAME:
 .. py:data:: JWT_REFRESH_COOKIE_NAME

flask_jwt_extended/config.py

@@ -118,6 +118,10 @@ def cookie_secure(self) -> bool:
     def cookie_domain(self) -> str:
         return current_app.config["JWT_COOKIE_DOMAIN"]
 
+    @property
+    def cookie_partitioned(self) -> bool:
+        return current_app.config["JWT_COOKIE_PARTITIONED"]
+
     @property
     def session_cookie(self) -> bool:
         return current_app.config["JWT_SESSION_COOKIE"]

flask_jwt_extended/jwt_manager.py

@@ -199,6 +199,7 @@ def _set_default_configuration_options(app: Flask) -> None:
         app.config.setdefault("JWT_COOKIE_DOMAIN", None)
         app.config.setdefault("JWT_COOKIE_SAMESITE", None)
         app.config.setdefault("JWT_COOKIE_SECURE", False)
+        app.config.setdefault("JWT_COOKIE_PARTITIONED", False)
         app.config.setdefault("JWT_CSRF_CHECK_FORM", False)
         app.config.setdefault("JWT_CSRF_IN_COOKIES", True)
         app.config.setdefault("JWT_CSRF_METHODS", ["POST", "PUT", "PATCH", "DELETE"])

flask_jwt_extended/utils.py

@@ -301,6 +301,7 @@ def set_access_cookies(
         domain=domain or config.cookie_domain,
         path=config.access_cookie_path,
         samesite=config.cookie_samesite,
+        partitioned=config.cookie_partitioned
     )
 
     if config.cookie_csrf_protect and config.csrf_in_cookies:
@@ -313,6 +314,7 @@ def set_access_cookies(
             domain=domain or config.cookie_domain,
             path=config.access_csrf_cookie_path,
             samesite=config.cookie_samesite,
+            partitioned=config.cookie_partitioned
         )
 
 
@@ -354,6 +356,7 @@ def set_refresh_cookies(
         domain=domain or config.cookie_domain,
         path=config.refresh_cookie_path,
         samesite=config.cookie_samesite,
+        partitioned=config.cookie_partitioned
     )
 
     if config.cookie_csrf_protect and config.csrf_in_cookies:
@@ -366,6 +369,7 @@ def set_refresh_cookies(
             domain=domain or config.cookie_domain,
             path=config.refresh_csrf_cookie_path,
             samesite=config.cookie_samesite,
+            partitioned=config.cookie_partitioned
         )
 
 
@@ -404,6 +408,7 @@ def unset_access_cookies(response: Response, domain: Optional[str] = None) -> No
         domain=domain or config.cookie_domain,
         path=config.access_cookie_path,
         samesite=config.cookie_samesite,
+        partitioned=config.cookie_partitioned
     )
 
     if config.cookie_csrf_protect and config.csrf_in_cookies:
@@ -416,6 +421,7 @@ def unset_access_cookies(response: Response, domain: Optional[str] = None) -> No
             domain=domain or config.cookie_domain,
             path=config.access_csrf_cookie_path,
             samesite=config.cookie_samesite,
+            partitioned=config.cookie_partitioned
         )
 
 
@@ -442,6 +448,7 @@ def unset_refresh_cookies(response: Response, domain: Optional[str] = None) -> N
         domain=domain or config.cookie_domain,
         path=config.refresh_cookie_path,
         samesite=config.cookie_samesite,
+        partitioned=config.cookie_partitioned
     )
 
     if config.cookie_csrf_protect and config.csrf_in_cookies:
@@ -454,6 +461,7 @@ def unset_refresh_cookies(response: Response, domain: Optional[str] = None) -> N
             domain=domain or config.cookie_domain,
             path=config.refresh_csrf_cookie_path,
             samesite=config.cookie_samesite,
+            partitioned=config.cookie_partitioned
         )