Skip to content

Commit

Permalink
Clarify that behavior applies to CORS requests
Browse files Browse the repository at this point in the history
  • Loading branch information
amaralis committed Jul 14, 2024
1 parent 6bcc7b2 commit c743f19
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion files/en-us/web/http/headers/set-cookie/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ To send multiple cookies, multiple **`Set-Cookie`** headers should be sent in th

> **Warning:** Browsers block frontend JavaScript code from accessing the `Set-Cookie` header, as required by the Fetch spec, which defines `Set-Cookie` as a [forbidden response-header name](https://fetch.spec.whatwg.org/#forbidden-response-header-name) that [must be filtered out](https://fetch.spec.whatwg.org/#ref-for-forbidden-response-header-name%E2%91%A0) from any response exposed to frontend code.
>
> [Browsers will ignore `Set-Cookie` headers](https://fetch.spec.whatwg.org/#cors-protocol-examples) unless the request that triggers the server response has a value of `'include'` set for the `credentials` property of the {{domxref("RequestInit")}} object passed as the `options` argument to the {{domxref("Request.Request","Request()")}} constructor. See also section [4.6, #15](https://fetch.spec.whatwg.org/#http-network-fetch) of the [Fetch Living Standard](https://fetch.spec.whatwg.org/), and [Using the Fetch API - Including credentials](/en-US/docs/Web/API/Fetch_API/Using_Fetch#including_credentials) for more guidance.
> When a request [uses CORS](/en-US/docs/Web/HTTP/CORS#what_requests_use_cors), [browsers will ignore `Set-Cookie` headers](https://fetch.spec.whatwg.org/#cors-protocol-examples) present in the server's response unless the request has a value of `'include'` set for the `credentials` property of the {{domxref("RequestInit")}} object passed as the `options` argument to the {{domxref("Request.Request","Request()")}} constructor. See also section [4.6, #15](https://fetch.spec.whatwg.org/#http-network-fetch) of the [Fetch Living Standard](https://fetch.spec.whatwg.org/), and [Using the Fetch API - Including credentials](/en-US/docs/Web/API/Fetch_API/Using_Fetch#including_credentials) for more guidance.
For more information, see the guide on [Using HTTP cookies](/en-US/docs/Web/HTTP/Cookies).

Expand Down

0 comments on commit c743f19

Please sign in to comment.