Fetch API not sending session cookies when used inside a Chrome Extension

Question

I'm trying to make a Chrome Extension which scrapes some details from Pull Requests on Github using the Fetch API, and then displays them elsewhere. I'm running into some problems when I try to use this with a non-public repository on Github. I believe this is related to CSRF protection, and the rules that govern Chrome extensions having access to session cookies.

I have the following in my extension's manifest.json:

"content_scripts": [{
    "matches": [
        "*://github.com/*/*/pulls"
    ],
    "js": ["script/underscore-1.8.3.min.js", "script/content.js"]
}],
"permissions": [
    "tabs",
    "activeTab",
    "*://github.com/*",
    "webNavigation"
]

But when I run the following from within my script/content.js:

fetch('/redacted/redacted/pull/4549', {credentials: 'same-origin'}).then((response) => {
    return response.text();
}).then((text) => {
    // do cool stuff
})

This produces a 404 response from Github. Inspecting this request with Chrome Inspector's network tab, I can see it is not sending my GitHub session header with the request.

If I make the very same request using the Javascript prompt in the Inspector, I can see a 200 response, and I can see that it is sending my session cookies.

My understanding was that specifying the Github domain in my manifest.json would mean my extension would have access to my session data in my content scripts, is this not correct? What should I be doing to make a valid request to this protected content?

Answer 1

According to Chrome blog, to include cookies you need credentials: 'include' instead of credentials: 'same-origin'.