No, if the server's API follows REST principles (which it should).
If in a fetch with
GET you set
credentials: "include" then the request will be performed and credentials will be included. But:
- response's content won't be made available to the browser when either
Access-Control-Allow-Origin: * or
Access-Control-Allow-Credentials: false (or if either of them is missing). So the client won't be able to read the response even if the server responded with something user-specific.
- since this is a
GET request then the server shouldn't do anything state-changing (this is the "follow REST" part)
DELETE in a cross-origin fetch with
credentials: "include" will require a preflight request beforehand -- to ask the server if these methods are allowed to be performed with credentials. So if the server does allow credentialed state-changing requests then it must reply to the preflight with headers
Access-Control-Allow-Origin: https://the-clients-origin.com and
(There is a slight exception to the previous for
POST requests with content-types either
text/plain. These are there for cross-origin form-submit handlers (someone correct me on this).)
Read more on MDN: CORS: Simple requests or Fetch specification.