Cookies and CORS: How Browsers Decide When to Send Credentials Cross-Origin

Short summary

This article explains that browsers do not send cookies with cross-origin fetch requests by default, and that credentials: 'include' is necessary but not sufficient. Cookie eligibility depends on Domain, Path, and SameSite attributes, and the server must return Access-Control-Allow-Credentials: true with an explicit Origin. A CORS error may mean the cookie was sent but the browser blocked JavaScript from reading the response.

• •Browsers omit cookies from cross-origin requests by default; credentials: 'include' is required to opt in
• •Cookie eligibility also depends on Domain, Path, and SameSite attributes regardless of the credentials flag
• •Server must return Access-Control-Allow-Credentials: true and an explicit (non-wildcard) Origin for JavaScript to access responses

Generated with AI, which can make mistakes.