From 644d13e629b600cc3b58db05555e9f9c00ba9a92 Mon Sep 17 00:00:00 2001
From: slhx agent <slhx@users.noreply.github.com>
Date: Mon, 25 May 2026 22:49:06 +0200
Subject: [PATCH] fix(js): preserve same-origin credentials

Send interaction and page-swap fetches with same-origin credentials so cookies/session/CSRF context stay available to integration-layer policy without broad CORS behavior.

req: auth/005
---
 slhx-js/runtime/slhx.js  | 6 +++++-
 slhx-js/tests/runtime.rs | 8 ++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/slhx-js/runtime/slhx.js b/slhx-js/runtime/slhx.js
index e09ed40..3ec8715 100644
--- a/slhx-js/runtime/slhx.js
+++ b/slhx-js/runtime/slhx.js
@@ -131,6 +131,7 @@
         method,
         body,
         headers,
+        credentials: "same-origin",
         signal: abort.signal,
       });
       if (pending.get(target)?.abort !== abort && policy === "latest") return;
@@ -158,7 +159,10 @@
   }
 
   async function navigateUrl(href, root, mode = "replace") {
-    const response = await fetch(href, { headers: { "X-SLHX-Partial": "1", "Accept": "text/html" } });
+    const response = await fetch(href, {
+      headers: { "X-SLHX-Partial": "1", "Accept": "text/html" },
+      credentials: "same-origin",
+    });
     if (!await applyResponse(response, root) && mode !== "none") {
       location.href = href;
       return;
diff --git a/slhx-js/tests/runtime.rs b/slhx-js/tests/runtime.rs
index e3e3d14..6b02937 100644
--- a/slhx-js/tests/runtime.rs
+++ b/slhx-js/tests/runtime.rs
@@ -9,6 +9,14 @@ fn runtime_posts_urlencoded_forms_by_default() {
     assert!(source.contains("application/x-www-form-urlencoded;charset=UTF-8"));
 }
 
+#[test]
+fn runtime_fetches_with_same_origin_credentials() {
+    // req: auth/005
+    let source = slhx_js::RUNTIME_JS;
+
+    assert_eq!(source.matches("credentials: \"same-origin\"").count(), 2);
+}
+
 #[test]
 fn runtime_handles_get_forms_without_request_body() {
     let source = slhx_js::RUNTIME_JS;