remove credentials when creating request object - #3728

sveltejs · Apr 6, 2022 · 4192304 · 4192304
1 parent d4ec813
commit 4192304
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 5 deletions.
diff --git a/.changeset/lazy-berries-decide.md b/.changeset/lazy-berries-decide.md
@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': patch
+---
+
+Remove credentials when creating request object in server-side fetch
diff --git a/packages/kit/src/runtime/server/page/load_node.js b/packages/kit/src/runtime/server/page/load_node.js
@@ -186,11 +186,18 @@ export async function load_node({
 						throw new Error('Request body must be a string');
 					}
 
-					response = await respond(new Request(new URL(requested, event.url).href, opts), options, {
-						getClientAddress: state.getClientAddress,
-						initiator: route,
-						prerender: state.prerender
-					});
+					response = await respond(
+						// we set `credentials` to `undefined` to workaround a bug in Cloudflare
+						// (https://github.com/sveltejs/kit/issues/3728) — which is fine, because
+						// we only need the headers
+						new Request(new URL(requested, event.url).href, { ...opts, credentials: undefined }),
+						options,
+						{
+							getClientAddress: state.getClientAddress,
+							initiator: route,
+							prerender: state.prerender
+						}
+					);
 
 					if (state.prerender) {
 						dependency = { response, body: null };