XMLHttpRequest: withCredentials property - Web APIs | MDN

This feature is well established and works across many devices and browser versions. It’s been available across browsers since July 2015. Learn moreSee full compatibilityReport feedback The XMLHttpRequest.withCredentials property is a boolean value that indicates whether or not cross-site Access-Control requests should be made using credentials such as cookies, authentication headers or TLS client

[shingo-sasaki-0529]

あ、XHR のほうは SameOrigin なら常にクレデンシャル送信するんだ。