Description
MDN URL
https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API/Using_Fetch
What specific section or headline is this issue about?
https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API/Using_Fetch#including_credentials
What information was incorrect, unhelpful, or incomplete?
I've been assuming this is how the "credentials": "include"
and "credentials": "same-origin"
work:
The browser stores a list of cookies, some of them related to credentials, some of them not. When the browser executes a fetch
with "credentials": "include"
or "credentials": "same-origin"
, the browser sends the credential-related cookies to the server behind the scenes. To send all stored cookies, the difference (i.e., all cookies - credential related cookies
) must be explicitly added to a cookies
header in the fetch()
call.
- Is this accurate? Or does
"credentials": "include"
and"credentials": "same-origin"
send all cookies, like this comment says? - If
"credentials": "include"
or"credentials": "same-origin"
andcookies
contain overlapping keys, which one is sent to the server?- If both are sent to the server, which one has precedence, the
credentials
or thecookies
?
- If both are sent to the server, which one has precedence, the
What did you expect to see?
I was reading this github comment, and couldn't confirm this detail (emphasis mine):
You should add them manually as headers. You can in fact use the same code for server and for client, because on client the Cookie headers are ignored and credentials: 'include' works instead.
fetch('/', { credentials: 'include', headers: {'Cookie': 'foo=bar;bar=foo'} })
If this is true, can it be mentioned somewhere in this article?
Do you have any supporting links, references, or citations?
If I'm requesting information that seems more appropriate for reference documentation, maybe it should go here instead: https://developer.mozilla.org/en-US/docs/Web/API/Request/credentials
Do you have anything more you want to share?
This may be the appropriate content to modify:
Credentials are cookies, TLS client certificates, or authentication headers containing a username and password.
MDN metadata
Page report details
- Folder:
en-us/web/api/fetch_api/using_fetch
- MDN URL: https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API/Using_Fetch
- GitHub URL: https://github.com/mdn/content/blob/main/files/en-us/web/api/fetch_api/using_fetch/index.md
- Last commit: 7591022
- Document last modified: 2025-04-28T15:45:41.000Z