Comparison
Credentialed requestvsSameSite cookie
Credentialed request
the cookie was not sent with the cross-origin fetch until you passed `credentials: 'include'`.
A cross-origin request that carries cookies, TLS client certificates or authorisation headers, which `fetch` omits by default. It requires the server to name the exact origin — a wildcard is rejected — and to set `Access-Control-Allow-Credentials`. This combination is the most common cause of an API that works when unauthenticated and fails as soon as a session is involved.
Full entry →SameSite cookie
the cookie stopped being sent when the request came from another site, and an embedded widget broke.
A cookie attribute controlling whether the cookie is attached to requests originating from other sites: `Strict` never, `Lax` only on top-level navigations, `None` always but only over HTTPS. `Lax` is now the default, which removed most cross-site request forgery by default and broke a generation of embedded widgets and payment redirects at the same time. It is a defence in depth, not a replacement for a CSRF token on state-changing requests.
Full entry →