Bug 311205 – Web Inspector: `Secure` cookies from insecure (HTTP/WS) localhost addresses are not visible in Inspector

• Component: Web Inspector
• Status: NEW

[Xyan]

Following the change in https://github.com/WebKit/WebKit/pull/61338, we need to remove the additional restrictions on Web Inspector that filter out `Secure` cookies only for secure schemes (HTTPS/WSS).

The code to change is here: https://github.com/WebKit/WebKit/blob/0d03f7a7f1a0d4772631497e146a060a5ab62839/Source/WebInspectorUI/UserInterface/Models/CookieStorageObject.js#L43

This additional filtering is not strictly necessary because the backends should already be doing this filtering.

We have to take additional considerations when making this change: specifically that multiple networking backends to WebKit must all filter out `Secure` cookies so that Web Inspector is not the only stopgap here. This is true for Cocoa and Soup, but not the case for curl.

The implications here are that we would need to make the curl backend filter out `Secure` cookies as well before landing this change. This also means that if the latest Web Inspector UI were to be used on an older curl backend, it would result in unexpected behavior where `Secure` cookies would be visible in the inspector even though they are not accessible to the page.

Bug for changes to make to curl: https://bugs.webkit.org/show_bug.cgi?id=310830

[Radar WebKit Bug Importer]

<rdar://problem/174248937>