diff --git a/files/en-us/web/http/headers/set-cookie/index.md b/files/en-us/web/http/headers/set-cookie/index.md index 74b20f83183df4a..937ebfbdf283d3f 100644 --- a/files/en-us/web/http/headers/set-cookie/index.md +++ b/files/en-us/web/http/headers/set-cookie/index.md @@ -12,7 +12,7 @@ To send multiple cookies, multiple **`Set-Cookie`** headers should be sent in th > **Warning:** Browsers block frontend JavaScript code from accessing the `Set-Cookie` header, as required by the Fetch spec, which defines `Set-Cookie` as a [forbidden response-header name](https://fetch.spec.whatwg.org/#forbidden-response-header-name) that [must be filtered out](https://fetch.spec.whatwg.org/#ref-for-forbidden-response-header-name%E2%91%A0) from any response exposed to frontend code. > -> [Browsers will ignore `Set-Cookie` headers](https://fetch.spec.whatwg.org/#cors-protocol-examples) unless the request that triggers the server response has a value of `'include'` set for the `credentials` property of the {{domxref("RequestInit")}} object passed as the `options` argument to the {{domxref("Request.Request","Request()")}} constructor. See also section [4.6, #15](https://fetch.spec.whatwg.org/#http-network-fetch) of the [Fetch Living Standard](https://fetch.spec.whatwg.org/), and [Using the Fetch API - Including credentials](/en-US/docs/Web/API/Fetch_API/Using_Fetch#including_credentials) for more guidance. +> When a request [uses CORS](/en-US/docs/Web/HTTP/CORS#what_requests_use_cors), [browsers will ignore `Set-Cookie` headers](https://fetch.spec.whatwg.org/#cors-protocol-examples) present in the server's response unless the request has a value of `'include'` set for the `credentials` property of the {{domxref("RequestInit")}} object passed as the `options` argument to the {{domxref("Request.Request","Request()")}} constructor. See also section [4.6, #15](https://fetch.spec.whatwg.org/#http-network-fetch) of the [Fetch Living Standard](https://fetch.spec.whatwg.org/), and [Using the Fetch API - Including credentials](/en-US/docs/Web/API/Fetch_API/Using_Fetch#including_credentials) for more guidance. For more information, see the guide on [Using HTTP cookies](/en-US/docs/Web/HTTP/Cookies).