Which behavior occurs when a browser encounters a ‘fetch’ request with ‘credentials: same-origin’ to a different domain?

Question

Web Development — Hard

Which behavior occurs when a browser encounters a ‘fetch’ request with ‘credentials: same-origin’ to a different domain?

Accepted Answer

When 'credentials' is set to 'same-origin', the browser will only include credentials (cookies, HTTP authentication) if the request is made to the same origin. If the request is cross-origin, the browser strips all credentials, even if the server provides the appropriate CORS headers. This is a security default to prevent unintended credential leakage to third-party domains.