enforce __Host- and __Secure- cookie name prefixes in CookieJar

[arshsmith1]

What do these changes do?

CookieJar.update_cookies stores cookies from a response without ever looking at the __Secure- / __Host- name prefixes defined in RFC 6265bis §4.1.3. Those prefixes exist so a server can trust that a cookie it sees really was set over HTTPS, host-locked (for __Host-), and with the Secure attribute. A sibling subdomain or an on-path party can currently forge one: sending Set-Cookie: __Host-sid=attacker; Domain=example.com; Path=/ from sub.example.com gets stored as a domain cookie and later sent to the apex https://example.com/, which is the opposite of the host-only guarantee. A browser rejects that cookie outright.

The check now lives inside update_cookies, right where the incoming morsel is available: a name that case-insensitively begins with __Secure- or __Host- is dropped unless it arrived over a secure origin with the Secure attribute, and __Host- additionally requires host-only (no Domain) with Path=/. Cookies seeded programmatically (no response host) are untouched.

Are there changes in behavior for the user?

A __Secure-/__Host- cookie that doesn't meet the prefix requirements is no longer accepted into the jar, matching browser behavior. Compliant cookies and all cookies without those prefixes are unaffected.

Is it a substantial burden for the maintainers to support this?

No. It is a self-contained guard in one method plus a small _is_secure_origin helper that mirrors the secure-origin logic filter_cookies already uses.

Related issue number

N/A

Checklist

• I think the code is well written
• Unit tests for the changes exist
• Documentation reflects the changes
• If you provide code modification, please add yourself to CONTRIBUTORS.txt
• Add a new news fragment into the CHANGES/ folder

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.97%. Comparing base (6ec1d11) to head (ca86660).
⚠️ Report is 1 commits behind head on master.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #13168   +/-   ##
=======================================
  Coverage   98.97%   98.97%           
=======================================
  Files         131      131           
  Lines       48824    48856   +32     
  Branches     2546     2552    +6     
=======================================
+ Hits        48324    48356   +32     
  Misses        376      376           
  Partials      124      124           

Flag	Coverage Δ
Autobahn	22.12% <21.87%> (-0.01%)	⬇️
CI-GHA	98.90% <100.00%> (+<0.01%)	⬆️
OS-Linux	98.67% <100.00%> (+<0.01%)	⬆️
OS-Windows	97.03% <100.00%> (+<0.01%)	⬆️
OS-macOS	97.93% <100.00%> (+<0.01%)	⬆️
Py-3.10	98.12% <100.00%> (+<0.01%)	⬆️
Py-3.11	98.38% <100.00%> (+<0.01%)	⬆️
Py-3.12	98.47% <100.00%> (+<0.01%)	⬆️
Py-3.13	98.44% <100.00%> (-0.01%)	⬇️
Py-3.14	98.47% <100.00%> (+<0.01%)	⬆️
Py-3.14t	97.56% <100.00%> (+<0.01%)	⬆️
Py-pypy-3.11	97.43% <100.00%> (+<0.01%)	⬆️
VM-macos	97.93% <100.00%> (+<0.01%)	⬆️
VM-ubuntu	98.67% <100.00%> (+<0.01%)	⬆️
VM-windows	97.03% <100.00%> (+<0.01%)	⬆️
cython-coverage	37.87% <9.37%> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[codspeed-hq]

Merging this PR will not alter performance

✅ 83 untouched benchmarks
⏩ 83 skipped benchmarks¹

---

_{Comparing arshsmith1:cookie-prefix-enforcement (ca86660) with master (6ec1d11)²}

Footnotes

1. 83 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

2. No successful run was found on master (7582e05) during the generation of this report, so 6ec1d11 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩