title: Fetch Not Sending Cookies
body: <p>I am having issues in fetch sending cookies when I use the following js snippet in the console (in developer tools) of my browser (tried chrome, firefox and edge):</p>
  
  <pre><code>fetch('http://127.0.0.1:3010/check', {
    credentials: 'include'
    method: 'GET'
  })
    .then(res=&gt;res.json())
    .then(jsonobj=&gt;{console.log(jsonbj)});
  </code></pre>
  
  <p>And here is my express code handling the api request:</p>
  
  <pre><code>var express = require('express');
  var path = require('path');
  var cookieParser = require('cookie-parser');
  var cors = require('cors');
  
  var app = express();
  app.use(cors({
      credentials: true,
      origin: 'https://www.youtube.com'
  ));
  app.use(express.json());
  app.use(express.urlencoded({ extended: false }));
  app.use(cookieParser());
  
  app.get('/check', (req, res)=&gt;{
    console.log(JSON.stringify(req.cookies));
    res.json({
      message: "COOL"
    });
  });
  </code></pre>
  
  <p>The fetch call is successful with the message COOL getting logged to the browser console. However, the NodeJS console prints empty objects {} or empty cookies.</p>
  
  <p><strong>For example</strong>, when I run the fetch request in the console of <a href="http://youtube.com/" rel="noreferrer">http://youtube.com/</a>, I would like the browser to send cookies on my localhost to my express server (I did this to simulate cookie sending in cross-site request). </p>
  
  <p><strong>EDIT 1: Also some of the cookies on my localhost have SameSite unset and the mdn docs says that those cookies can be sent to server in cross site requests too</strong>:</p>
  
  <blockquote>
    <p>The default behavior if the flag is not set, or not supported by the
    browser, is to include the cookies in any request, including
    cross-origin requests.</p>
  </blockquote>
  
  <p>Either the snippet from mdn docs is wrong or the implementations of SameSite by browsers is inconsistent. I am confused.</p>
  
  <p><strong>EDIT 2</strong>: Also this page <a href="https://textslashplain.com/2019/09/30/same-site-cookies-by-default/" rel="noreferrer">https://textslashplain.com/2019/09/30/same-site-cookies-by-default/</a> says </p>
  
  <blockquote>
    <p>In Chrome 80 and later, cookies will default to SameSite=Lax. This
    means that cookies will automatically be sent only in a first party
    context unless they opt-out by explicitly setting a directive of None:</p>
  </blockquote>
  
  <p>Are the mdn docs really incorrect then about the default value of SameSite?</p>
  
  <p><strong>EDIT 3</strong>: I have proposed an edit to the mdn docs and it has been accepted.</p>