gui: enable RPC server by default #17301

This PR enables the RPC server by default for GUI users (with cookie based authentication).

Alternatively I could add GUI setting.

Some recent projects that would benefit from this:

1. HWI: especially once it has a GUI: https://github.com/bitcoin-core/HWI/issues/263
2. Junction: https://github.com/justinmoon/junction

These applications only need bitcoind / bitcoin-qt to run when they're being used.

What are the arguments against? Security? Any open issues for this?

What are the arguments against? Security? Any open issues for this?

Yes, the reason the RPC server has always been disabled for the GUI by default is that it's not necessary for most GUI users, so it reduces the attack surface without any adverse consequences.

If new developments cause it to be more necessary, this can be reconsidered, of course.

I guess most GUI users don't use the RPC interface and it's unclear to me if it is worth to enable it by default for better integration with HWI/junction.

Though better GUI integration to enable the RPC interface would be desirable IMO. Maybe a setting that could directly enable the interface without a restart (yes, needs some refactoring)...

W.r.t. security, some of the trade-offs are non-obvious: for example it's mostly GUI users that tend to run the software on the same computer as a browser.

As long as the RPC is reachable through localhost TCP (and not something off-limits to browsers like a UNIX socket), with RPC enabled there is the increased risk that malware running in the browser (with or without the aid of a partial sandbox evasion) attacks the wallet.

In general I don't think users expect non-server applications to listen to TCP ports unless the user has explicitly opted-in to such behaviour.

As a user I expect the default mode of operation to minimise available attack surfaces ("secure by default").

It feels risky to increase the attack surface for all GUI users users to accommodate the needs for a subset of said users.

I suggest adding a GUI setting instead to make this opt-in.

I'd agree. A GUI setting to quickly enable this, for users that need it, would make sense.

To be clear, I'd feel better with enabling this by default after UNIX sockets for RPC are implemented (e.g.#9919 resurrected) and UNIX-socket-only is the default.

Ok, so I'll either add a GUI setting, or wait for UNIX sockets, whichever comes first...