Which behavior occurs when a browser encounters a 'fetch' request with 'credentials: same-origin' to a different domain?

Explanation

When 'credentials' is set to 'same-origin', the browser will only include credentials (cookies, HTTP authentication) if the request is made to the same origin. If the request is cross-origin, the browser strips all credentials, even if the server provides the appropriate CORS headers. This is a security default to prevent unintended credential leakage to third-party domains.

Key points

same-origin mode restricts credentials to the origin.
Cross-origin requests with this mode omit cookies.
This is the default behavior for fetch requests.
CORS headers cannot override this specific restriction.

Ready to go further?

Start full exam Practice more questions

Which behavior occurs when a browser encounters a ‘fetch’ request with ‘credentials: same-origin’ to a different domain?