3 ms·
> XMLHttpRequest always sends browser cookies No: The XMLHttpRequest.withCredentials property is a boolean value that indicates whether or not cross-site Acce
by tantalor 5y ago
> XMLHttpRequest always sends browser cookies
No:
The XMLHttpRequest.withCredentials property is a boolean value that indicates whether or not cross-site Access-Control requests should be made using credentials such as cookies, authorization headers or TLS client certificates.
https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/withCredentials https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequ...
- simlevesque 5y agoEven more important: it's value is `false` by default.
- re 5y agoThe blog post seems to only be referring to same-site requests for XHR, whereas your response is only referring to cross-site requests. A more complete correction would be: XMLHttpRequest always sends browser cookies for same-origin requests. They are not included for cross-origin requests unless explicitly requested. Fetch does not send cookies by default for either type of request, unless explicitly requested. Also note that the server must use the Access-Control-Allow-Credentials header for the response to be made available to the client code when making a cross-origin request with credentials. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Ac...