title: Javascript fetch is not sending Cookie Header (CORS)
body: <p>I am trying to send Cookies to a PHP Script within a javascript fetch CORS request. The Request starts on <code>https://sub1.example.com</code> and contains the following options:</p>
  <pre><code>let response = await fetch('https://sub2.example.com/target.php', {
      method: &quot;POST&quot;,
      headers: headers,
      body: formData,
      mode: 'cors',
      credentials: 'include',
      cache: 'no-store'
  });
  </code></pre>
  <p>The corresponding PHP Script sets the following Headers:</p>
  <pre><code>header('Access-Control-Allow-Origin: https://www.example.com');
  header('Access-Control-Allow-Methods: POST, OPTIONS');
  header('Access-Control-Allow-Credentials: true');
  header('Access-Control-Allow-Headers: Origin, Content-Type, Accept, Authorization, X-Request-With, Set-Cookie, Cookie, Bearer');
  </code></pre>
  <p>But the Cookie Header is not send with the request. I also tried:</p>
  <pre><code>let headers = new Headers();
  headers.set('Cookie', document.cookie);
  </code></pre>
  <p>That also had no effect. What exactly am I doing wrong here?</p>
  <p>I checked the Network Tab in the Development Tools. Also <code>$_COOKIE</code> in the PHP Script is empty. There is absolutely no error. I can also see that the Cookie Header is sent in any not CORS <code>fetch</code> request.</p>
  <p>EDIT: Here are the Settings of one of the Cookies:</p>
  <pre><code>Name: PHPSESSID
  Path: /
  Secure: true
  SameSite: none
  </code></pre>
  <p>I can't share the Domain because it's not public. But the Cookie Domain has the same Value as the Origin in the Request Header (Minus the https://).</p>
  <p>EDIT 2: Changed the fetch URL to make clearer what's happening.</p>