title: Fetch is not sending secure cookie during cross domain POST request
body: <p>I cannot get this fetch request to correctly send the cookie (session id that is successfully stored in the Chrome browsers application tab within cookies). The cookie is a python bottle created, beaker.session.id cookie that is marked secure.</p>
  
  <p><a href="https://i.stack.imgur.com/ERmuU.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/ERmuU.png" alt="enter image description here"></a></p>
  
  <p>I have my bottle server configured to deal with CORS requests and cookies with the following headers being returned:</p>
  
  <pre><code>Access-Control-Allow-Credentials →true
  Access-Control-Allow-Headers →Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token, Authorization
  Access-Control-Allow-Methods →PUT, GET, POST, DELETE, OPTIONS
  Access-Control-Allow-Origin →http://localhost:3000
  </code></pre>
  
  <p>My javascript code is: </p>
  
  <pre><code> fetch("https://#.#.#.#/session-status", 
      {
          credentials: "include",
          method: "post",
          headers: {
              'Content-Type': 'application/json',
          },
          body: JSON.stringify({
              "id": id
          }),
      }).then(res =&gt; {
          return res.json()
  </code></pre>
  
  <p>What could be causing this issue? The preflight OPTIONS request succeeds with a 200 OK, but the POST request does not send the necessary headers which include the session id.</p>