django-cookie-delete-settings-and-CVE-2026-35192.patch

--- django/contrib/messages/storage/cookie.py.orig	2020-08-13 11:10:36.719177122 +0200
+++ django/contrib/messages/storage/cookie.py	2020-08-13 11:45:23.503463150 +0200
@@ -109,6 +109,8 @@
             response.delete_cookie(
                 self.cookie_name,
                 domain=settings.SESSION_COOKIE_DOMAIN,
+                secure=settings.SESSION_COOKIE_SECURE or None,
+                httponly=settings.SESSION_COOKIE_HTTPONLY or None,
                 samesite=settings.SESSION_COOKIE_SAMESITE,
             )
 
--- django/http/response.py.orig	2025-12-02 22:12:05.197283001 +0000
+++ django/http/response.py	2025-12-02 22:26:01.396576013 +0000
@@ -286,20 +286,28 @@
         value = signing.get_cookie_signer(salt=key + salt).sign(value)
         return self.set_cookie(key, value, **kwargs)

-    def delete_cookie(self, key, path="/", domain=None, samesite=None):
+    def delete_cookie(self, key, path="/", domain=None, secure=False, httponly=False, samesite=None):
         # Browsers can ignore the Set-Cookie header if the cookie doesn't use
         # the secure flag and:
         # - the cookie name starts with "__Host-" or "__Secure-", or
         # - the samesite is "none".
-        secure = key.startswith(("__Secure-", "__Host-")) or (
-            samesite and samesite.lower() == "none"
-        )
+        if key in self.cookies:
+            domain     = self.cookies[key].get("domain", domain)
+            secure     = self.cookies[key].get("secure", secure)
+            httponly   = self.cookies[key].get("httponly", httponly)
+            samesite   = self.cookies[key].get("samesite", samesite)
+        else:
+            secure = secure or (
+                key.startswith(("__Secure-", "__Host-")) or
+                (samesite and samesite.lower() == "none")
+            )
         self.set_cookie(
             key,
             max_age=0,
             path=path,
             domain=domain,
             secure=secure,
+            httponly=httponly,
             expires="Thu, 01 Jan 1970 00:00:00 GMT",
             samesite=samesite,
         )
--- django/contrib/sessions/middleware.py.old	2026-05-12 15:18:07.673997003 +0000
+++ django/contrib/sessions/middleware.py	2026-05-12 15:18:15.770997007 +0000
@@ -38,12 +38,15 @@
                 settings.SESSION_COOKIE_NAME,
                 path=settings.SESSION_COOKIE_PATH,
                 domain=settings.SESSION_COOKIE_DOMAIN,
+                secure=settings.SESSION_COOKIE_SECURE or None,
+                httponly=settings.SESSION_COOKIE_HTTPONLY or None,
                 samesite=settings.SESSION_COOKIE_SAMESITE,
             )
-            patch_vary_headers(response, ("Cookie",))
+            need_vary_cookie = True
         else:
-            if accessed:
-                patch_vary_headers(response, ("Cookie",))
+            # If the session was accessed, it must be varied on, regardless of
+            # whether it was modified or will be saved.
+            need_vary_cookie = accessed
             if (modified or settings.SESSION_SAVE_EVERY_REQUEST) and not empty:
                 if request.session.get_expire_at_browser_close():
                     max_age = None
@@ -74,4 +77,8 @@
                         httponly=settings.SESSION_COOKIE_HTTPONLY or None,
                         samesite=settings.SESSION_COOKIE_SAMESITE,
                     )
+                    # With a session cookie set, it must be varied on.
+                    need_vary_cookie = True
+        if need_vary_cookie:
+            patch_vary_headers(response, ("Cookie",))
         return response