From 1036708e0e75ecc3c2b90b9a7743328e6f198097 Mon Sep 17 00:00:00 2001
From: Miguel Serrano <mserranom@users.noreply.github.com>
Date: Wed, 27 Jan 2021 11:07:57 +0100
Subject: [PATCH] Merge pull request #3600 from
 overleaf/ae-credentials-same-origin

Explicitly set credentials: same-origin on fetch requests

GitOrigin-RevId: 17204554f560e2a04b35c631f571fd73f91efadd
---
 services/web/frontend/js/infrastructure/fetch-json.js | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/services/web/frontend/js/infrastructure/fetch-json.js b/services/web/frontend/js/infrastructure/fetch-json.js
index ecd873bf34..f9d78657a4 100644
--- a/services/web/frontend/js/infrastructure/fetch-json.js
+++ b/services/web/frontend/js/infrastructure/fetch-json.js
@@ -23,7 +23,13 @@ export function deleteJSON(path, options) {
 
 function fetchJSON(
   path,
-  { body = {}, headers = {}, method = 'GET', ...otherOptions }
+  {
+    body = {},
+    headers = {},
+    method = 'GET',
+    credentials = 'same-origin',
+    ...otherOptions
+  }
 ) {
   const options = {
     ...otherOptions,
@@ -33,6 +39,7 @@ function fetchJSON(
       'X-Csrf-Token': window.csrfToken,
       Accept: 'application/json'
     },
+    credentials,
     method
   }