Fetch missing credentials

Skill viditkbhatnagar/immunize/src/immunize/patterns/fetch-missing-credentials

A curated pattern library that stops AI coding assistants from repeating common runtime errors. No API key. No LLM calls at runtime.

Install

npx -y skills add viditkbhatnagar/immunize --skill fetch-missing-credentials

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use when writing cross-origin fetch() calls that require cookies or session auth to ensure `credentials: 'include'` is set.

SKILL.md

1.5 KB, as published. Nobody here has run it

fetch-missing-credentials

When you call a cross-origin endpoint that requires cookies, session tokens, or any credentialed auth, include credentials: 'include' in the fetch options. Browsers default to credentials: 'same-origin', which drops cookies on cross-origin requests — the backend rejects the call with 401/403 and the response fails CORS preflight.

Example

Wrong — bare fetch to another origin; cookies won't be sent:

async function fetchUser() {
  const response = await fetch('https://api.example.com/me');
  return response.json();
}

Right — credentials flag forces cookies to travel:

async function fetchUser() {
  const response = await fetch('https://api.example.com/me', {
    credentials: 'include',
  });
  return response.json();
}

Server side must match

For credentials: 'include' to work, the server must respond with Access-Control-Allow-Credentials: true AND an explicit Access-Control-Allow-Origin: <origin> (never *). If either is missing, the browser blocks the response even though the network call succeeded.

When not to use it

Same-origin requests, public endpoints, and requests that rely on a Bearer token in the Authorization header don't need this flag. Adding it unnecessarily is a minor security footgun — the browser sends cookies the endpoint doesn't care about.