From 3a8e7d1f4fbad22c5a7e0f64a1c5545b9f1f3ce4 Mon Sep 17 00:00:00 2001
From: Leo Vasanko <git@vasanko.com>
Date: Tue, 27 Jan 2026 15:23:19 +0000
Subject: [PATCH] Remove credentials: 'include', a mechanism that we don't
 actually use.

---
 e2e/tests/20-api-auth.spec.ts | 4 ++--
 examples/index.html           | 4 ++--
 frontend/src/utils/api.js     | 3 +--
 3 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/e2e/tests/20-api-auth.spec.ts b/e2e/tests/20-api-auth.spec.ts
index 32a831e..6f268b7 100644
--- a/e2e/tests/20-api-auth.spec.ts
+++ b/e2e/tests/20-api-auth.spec.ts
@@ -84,7 +84,7 @@ async function makeApiCall(page: Page, url: string, method = 'GET'): Promise<{ s
           // Wait a tick for the page's handler to retry, then make our own call
           setTimeout(async () => {
             try {
-              const response = await fetch(url, { method, credentials: 'include' });
+              const response = await fetch(url, { method });
               if (response.status === 204) {
                 resolve({ status: 204 });
               } else if (response.ok) {
@@ -111,7 +111,7 @@ async function makeApiCall(page: Page, url: string, method = 'GET'): Promise<{ s
       setTimeout(async () => {
         if (resolved) return;
         try {
-          const response = await fetch(url, { method, credentials: 'include' });
+          const response = await fetch(url, { method });
           // Only resolve if this is a success or non-auth error
           if (response.status !== 401 && response.status !== 403) {
             if (resolved) return;
diff --git a/examples/index.html b/examples/index.html
index 0b94774..28a9575 100644
--- a/examples/index.html
+++ b/examples/index.html
@@ -96,7 +96,7 @@
         async function apiCall(url, method = 'GET') {
             log(`${method} ${url}...`);
 
-            const response = await fetch(url, { method, credentials: 'include' });
+            const response = await fetch(url, { method });
 
             // Server returns 401 (login/reauth) or 403 (missing permissions)
             // with a JSON body containing the iframe URL for authentication
@@ -131,7 +131,7 @@
         }
 
         async function logout() {
-            await fetch('/auth/api/logout', { method: 'POST', credentials: 'include' });
+            await fetch('/auth/api/logout', { method: 'POST' });
             log('Logged out');
         }
 
diff --git a/frontend/src/utils/api.js b/frontend/src/utils/api.js
index d48d985..e749535 100644
--- a/frontend/src/utils/api.js
+++ b/frontend/src/utils/api.js
@@ -88,7 +88,7 @@ export async function getAuthIframeUrl(mode = 'login') {
   }
 
   // Fetch from forward endpoint - it returns URL in auth.iframe on 401/403
-  const response = await fetch('/auth/api/forward', { credentials: 'include' })
+  const response = await fetch('/auth/api/forward')
   if (response.status === 401 || response.status === 403) {
     const data = await response.json()
     if (data.auth?.iframe) {
@@ -321,7 +321,6 @@ export async function apiJson(url, options = {}) {
  */
 export async function fetchJson(url, options = {}) {
   const fetchOptions = {
-    credentials: 'include',
     ...options,
     headers: {
       'Accept': 'application/json',