Merge pull request #3600 from overleaf/ae-credentials-same-origin

Explicitly set credentials: same-origin on fetch requests

GitOrigin-RevId: 17204554f560e2a04b35c631f571fd73f91efadd

services/web/frontend/js/infrastructure/fetch-json.js

@@ -23,7 +23,13 @@ export function deleteJSON(path, options) {
 
 function fetchJSON(
   path,
-  { body = {}, headers = {}, method = 'GET', ...otherOptions }
+  {
+    body = {},
+    headers = {},
+    method = 'GET',
+    credentials = 'same-origin',
+    ...otherOptions
+  }
 ) {
   const options = {
     ...otherOptions,
@@ -33,6 +39,7 @@ function fetchJSON(
       'X-Csrf-Token': window.csrfToken,
       Accept: 'application/json'
     },
+    credentials,
     method
   }