feat: Add RFC 6761–compliant localhost loopback checks so secure cookies work on localhost (fixes: #382)

[Chriss4123]

fixes: #382

Description

This commit extends how cookies are treated in secure contexts by fully recognizing localhost and loopback IPs as trustworthy origins, matching the de facto behavior of all modern browsers and RFC 6761. Previously, tough-cookie defaulted secure to true only for https: and wss: URLs, causing cookies with secure to not work with localhost.

What Changed

1. New secureContext.ts

   • Implements isPotentiallyTrustworthy(url) by checking:
     • Schemes: https or wss
     • Loopback IPs: 127.0.0.1/8 and ::1
     • Hostnames: localhost and *.localhost
   • Adapted from Chromium’s IsLocalhost, IsLoopback and HostNoBracketsPiece, located at:
     • IsLocalhost
     • IsLoopback
     • HostNoBracketsPiece

2. cookieJar.ts Update

• Replaced the old check which only accounts for https and wss schemes:

const secure =
  context.protocol &&
  (context.protocol == 'https:' || context.protocol == 'wss:')

• with the new isPotentiallyTrustworthy function which accounts for secure schemes, localhost addresses and loopback addresses.

No existing functionality is removed. Where the old check would return true, so does the new check. The only added functionality is treating localhost addresses and loopback addresses as secure contexts which was previously not present.

All modern browsers (Chrome et. al) support secure cookies on localhost so it only makes sense tough-cookie supports this too.

[colincasey]

@Chriss4123 thanks for this pull request! I try to review it by the end of the week.

[Chriss4123]

@colincasey I've completed all the requested changes and also added a comment linking a potentially trustworthy origin and the notion of a "secure" connection in draft-ietf-httpbis-rfc6265bis-19.

I'm ready for you to re-review the PR.

[Chriss4123]

Will look at the integration tests later and find what is causing these issues. Will let you know once all is good.

[colincasey]

Thanks @Chriss4123, I'll hold off on approval until it's clearer why jsdom tests would fail with this code included.