Request: credentials property

Baseline Widely available

This feature is well established and works across many devices and browser versions. It’s been available across browsers since March 2017.

Note: This feature is available in Web Workers.

The credentials read-only property of the Request interface reflects the value given to the Request() constructor in the credentials option. It determines whether or not the browser sends credentials with the request, as well as whether any Set-Cookie response headers are respected.

Credentials are cookies, TLS client certificates, or authentication headers containing a username and password.

See Including credentials for more details.

Value

A string with one of the following values:

omit

Never send credentials in the request or include credentials in the response.

same-origin

Only send and include credentials for same-origin requests.

include

Always include credentials, even for cross-origin requests.

Examples

In the following snippet, we create a new request using the Request() constructor (for an image file in the same directory as the script), then save the request credentials in a variable:

js
const request = new Request("flowers.jpg");
const credentials = request.credentials; // returns "same-origin" by default

Specifications

Specification
Fetch
# ref-for-dom-request-credentials②

Browser compatibility

Report problems with this compatibility data on GitHub
desktopmobileserver
Chrome
Edge
Firefox
Opera
Safari
Chrome Android
Firefox for Android
Opera Android
Safari on iOS
Samsung Internet
WebView Android
WebView on iOS
Deno
Node.js
credentials
Default value same-origin

Legend

Tip: you can click/tap on a cell for more information.

Full support
Full support
No support
No support

See also