Safari does not support localhost exception for Secure cookies

[Mattia-Rollo]

Hi @hamishwillee,

As per your request on mdn/content#41795, I'm opening this PR to add the note about Safari's localhost exception for Secure cookies directly to the BCD.

I've added the note to the main Set-Cookie support block for Safari, as Secure isn't tracked as a separate sub-feature. Please let me know if this is the correct location!

---

Summary

Adds a BCD note to the Set-Cookie header, clarifying that Safari does not support the localhost exception for the Secure attribute.

Test results and supporting details

This is a data-only change to add a note.

Supporting information and related discussion:

• Original WebKit bug report: https://bugs.webkit.org/show_bug.cgi?id=281149
• This change follows the request from @hamishwillee in the related mdn/content PR (see below).

Related issues

Fixes mdn/content#41366
Addresses discussion in mdn/content#41795

[github-actions]

Tip: Review these changes grouped by change (recommended for most PRs), or grouped by feature (for large PRs).

[caugner]

Is this exception mentioned in the spec?

[Mattia-Rollo]

Hi @caugner,

Thanks so much for the review and the very helpful suggestion! I've just committed your change.

You're spot on about the spec. It looks like the localhost exception isn't in the original RFC 6265, but is more of a modern browser convention for developer experience. Your new wording describes Safari's behavior much more accurately.

Appreciate the help!

[caugner]

@Mattia-Rollo Just to double-check: Chrome and Safari apply this exception, and send Secure cookies to unsecured localhost endpoints?

Edit: Also, have you considered adding the note to the Cookie header additionally/instead: https://github.com/mdn/browser-compat-data/blob/main/http/headers/Cookie.json

[Mattia-Rollo]

Hi @caugner,

Thanks for the review!

To answer your double-check: Yes, that is correct. Chrome and Firefox apply the exception (allowing Secure cookies on localhost), while Safari does not. This behavior is confirmed by the WebKit bug report I linked (#281149), which tracks this exact lack of support in Safari compared to other browsers.

Regarding the location of the note: That is a great point. Since the documented behavior is the User Agent's (Safari) decision on whether to send the cookie, placing the note under the Cookie header is indeed more appropriate than Set-Cookie.

I can move the note to http/headers/Cookie.json. Please confirm if you'd like me to delete the note from Set-Cookie.json entirely, or just move it.

[caugner]

@Mattia-Rollo Thanks for confirming. Let's duplicate the note to Cookies instead of moving.

[Mattia-Rollo]

Done! Duplicated the note to Cookie.json as requested.