How Browsers Decide Whether to Send Cookies in Cross-Origin Requests

A common misconception in web development is that correctly configuring CORS automatically ensures cookies are sent with cross-origin requests, but browsers withhold cookies and credentials by default. To include cookies, developers must explicitly set the credentials: 'include' option in fetch or XMLHttpRequest calls, though this alone does not guarantee transmission. The browser then evaluates each cookie against its own rules — including Domain, Path, and SameSite attributes — before deciding whether to send it. On the server side, responses must include Access-Control-Allow-Credentials: true alongside an explicit origin in Access-Control-Allow-Origin, as wildcard origins are incompatible with credentialed requests. Notably, a CORS error does not always mean a cookie was blocked from being sent; it may simply mean the browser prevented JavaScript from reading the server's response.