189888 2018-09-22 12:21:57 -0700 Change default credentials mode for module scripts from omit to same-origin 2024-03-17 08:07:24 -0700 1 1 1 Unclassified WebKit DOM Safari 11 Unspecified Unspecified RESOLVED DUPLICATE 210326 InRadar P2 Normal --- 1 domfarolino webkit-unassigned achristensen annevk cdumez d fpizlo webkit-bug-importer youennf ysuzuki oldest_to_newest 1462399 0 domfarolino 2018-09-22 12:21:57 -0700 The HTML Standard is changing such that module scripts (<script type=module>), and their descendants are fetched with "same-origin" credentials mode [1]. This means credentials must be included on same-origin module scripts requests by default. See point (1) in the following HTML PR: https://github.com/whatwg/html/pull/3656#issuecomment-421589162. Some of the other points in that PR are pending spec finalization, and a separate issue should be filed for them. [1]: https://fetch.spec.whatwg.org/#concept-request-credentials-mode 1463720 1 webkit-bug-importer 2018-09-26 13:25:21 -0700 <rdar://problem/44805666> 1467537 2 d 2018-10-09 13:45:14 -0700 Spec change has now landed. See also #171550. Web platform tests were changed in https://github.com/web-platform-tests/wpt/pull/13176 , with some additional related tests for module workers in https://github.com/web-platform-tests/wpt/pull/11274 and some additional test coverage ideas for dynamic import in https://github.com/web-platform-tests/wpt/issues/13426 2021646 3 annevk 2024-03-17 08:07:24 -0700 *** This bug has been marked as a duplicate of bug 210326 ***