Progressive Web Application Development by Example

Managing request credentials

By default, fetch does not append cookies to requests. This is good for both security and performance. In most scenarios, accessing an API does require cookie-based authentication. For these scenarios, you need to set the credentials property to either same-origin or include. The default value is omit.

By setting the credentials option to include or same-origin, the request will include the authentication cookies. The include value triggers the request object to include the credentials for any target origin, and the same-origin limits the credentials to the same-origin:

var myRequest = new Request("./api/podcast/" + id + ".json", { mode: "cors", credentials: "include" }); fetch(myRequest).then(function(response) ...