fix(js): preserve same-origin credentials

Send interaction and page-swap fetches with same-origin credentials so cookies/session/CSRF context stay available to integration-layer policy without broad CORS behavior. req: auth/005
2026-05-25 22:49:06 +02:00
parent f6bfde3675
commit 644d13e629
2 changed files with 13 additions and 1 deletions
@@ -9,6 +9,14 @@ fn runtime_posts_urlencoded_forms_by_default() {
    assert!(source.contains("application/x-www-form-urlencoded;charset=UTF-8"));
 }

+#[test]
+fn runtime_fetches_with_same_origin_credentials() {
+    // req: auth/005
+    let source = slhx_js::RUNTIME_JS;
+
+    assert_eq!(source.matches("credentials: \"same-origin\"").count(), 2);
+}
+
 #[test]
 fn runtime_handles_get_forms_without_request_body() {
    let source = slhx_js::RUNTIME_JS;