non-default credentials and request mode

src/browser/Frame.zig

@@ -859,6 +859,8 @@ pub fn navigate(self: *Frame, request_url: [:0]const u8, opts: NavigateOpts) !vo
         .throttle = self.parent == null,
         .origin = self.origin,
         .resource_type = .document,
+        .request_mode = .navigate,
+        .credentials_mode = .include,
         .header_callback = frameHeaderDoneCallback,
         .data_callback = frameDataCallback,
         .done_callback = frameDoneCallback,
@@ -2383,6 +2385,8 @@ pub fn loadExternalStylesheet(self: *Frame, link: *Element.Html.Link, href: []co
         .url = resolved,
         .method = .GET,
         .origin = self.origin,
+        .request_mode = .no_cors,
+        .credentials_mode = .same_origin,
         .resource_type = .stylesheet,
         .shutdown_callback = HttpClient.noopShutdown, // syncRequest installs its own
     }, &self._http_owner) catch |err| {

src/browser/ScriptManagerBase.zig

@@ -249,6 +249,9 @@ pub fn preloadImport(self: *ScriptManagerBase, url: [:0]const u8, referrer: []co
         .ctx = script,
         .url = url,
         .method = .GET,
+        .origin = owner.origin(),
+        .request_mode = .cors,
+        .credentials_mode = .same_origin,
         .resource_type = .script,
         .start_callback = if (log.enabled(.http, .debug)) Script.startCallback else null,
         .header_callback = Script.headerCallback,
@@ -438,6 +441,9 @@ pub fn getAsyncImport(self: *ScriptManagerBase, url: [:0]const u8, cb: ImportAsy
         .url = url,
         .method = .GET,
         .resource_type = .script,
+        .origin = owner.origin(),
+        .request_mode = .cors,
+        .credentials_mode = .same_origin,
         .start_callback = if (log.enabled(.http, .debug)) Script.startCallback else null,
         .header_callback = Script.headerCallback,
         .data_callback = Script.dataCallback,

src/browser/frame/resource_load.zig

@@ -80,6 +80,8 @@ pub fn image(frame: *Frame, img: *Element.Html.Image, src: []const u8) !void {
         .url = resolved,
         .method = .GET,
         .origin = frame.origin,
+        .request_mode = .no_cors,
+        .credentials_mode = .same_origin,
         .resource_type = .image,
         .headers_only = true,
         .header_callback = ImageLoad.headerCallback,

src/browser/webapi/SharedWorkerGlobalScope.zig

@@ -106,6 +106,8 @@ pub fn init(frame: *Frame, url: [:0]const u8, name: []const u8, worker_type: Wor
         .url = owned_url,
         .resource_type = .worker,
         .origin = frame.origin,
+        .credentials_mode = .same_origin,
+        .request_mode = .same_origin,
         .header_callback = httpHeaderCallback,
         .data_callback = httpDataCallback,
         .done_callback = httpDoneCallback,

src/browser/webapi/Worker.zig

@@ -107,6 +107,8 @@ pub fn init(url: []const u8, options: ?WorkerOptions, frame: *Frame) !*Worker {
         .loader_id = self._loader_id,
         .resource_type = if (self._type == .module) .script else .worker,
         .origin = frame.origin,
+        .request_mode = .same_origin,
+        .credentials_mode = .same_origin,
         .header_callback = httpHeaderCallback,
         .data_callback = httpDataCallback,
         .done_callback = httpDoneCallback,

src/browser/webapi/WorkerGlobalScope.zig

@@ -431,6 +431,8 @@ fn importScript(self: *WorkerGlobalScope, arena: Allocator, url: [:0]const u8) !
         .method = .GET,
         .resource_type = .worker,
         .origin = self.origin,
+        .request_mode = .same_origin,
+        .credentials_mode = .same_origin,
         .shutdown_callback = HttpClient.noopShutdown, // syncRequest installs its own
     }, &self._http_owner) catch |err| {
         log.warn(.http, "importScript", .{ .url = resolved_url, .err = err });

src/browser/webapi/net/EventSource.zig

@@ -180,6 +180,8 @@ fn connect(self: *EventSource) !void {
         .method = .GET,
         .cookies = cookie_support,
         .origin = exec.origin(),
+        .request_mode = .cors,
+        .credentials_mode = if (self._with_credentials) .include else .same_origin,
         .resource_type = .eventsource,
         .streaming = true,
         .header_callback = httpHeaderDoneCallback,

src/browser/webapi/net/XMLHttpRequest.zig

@@ -317,6 +317,7 @@ pub fn send(self: *XMLHttpRequest, body_: ?BodyInit, exec_: *const Execution) !v
         .body = self._request_body,
         .cookies = cookie_support,
         .credentials_mode = if (self._with_credentials) .include else .same_origin,
+        .request_mode = .cors,
         .origin = exec.origin(),
         .resource_type = .xhr,
         .timeout_ms = self._timeout,

src/network/CorsGate.zig

@@ -509,6 +509,8 @@ fn fetchThenResume(self: *CorsGate, transfer: *Transfer) !void {
         .cookie_jar = null,
         .cookie_origin = transfer.req.cookie_origin,
         .origin = transfer.req.origin,
+        .credentials_mode = .omit,
+        .request_mode = .no_cors,
         .ctx = ctx,
         .header_callback = CorsPreflightContext.headerCallback,
         .done_callback = CorsPreflightContext.doneCallback,

src/network/HttpClient.zig

@@ -1850,8 +1850,8 @@ pub const Request = struct {
     redirect: RedirectMode = .follow,
     referrer_policy: ?referrer.Policy = null,
     basic_auth_credentials: ?[:0]const u8 = null,
-    credentials_mode: CredentialsMode = .same_origin,
-    request_mode: RequestMode = .cors,
+    credentials_mode: CredentialsMode,
+    request_mode: RequestMode,
     timeout_ms: u32 = 0,
     skip_cache: bool = false,
 

src/network/RobotsGate.zig

@@ -117,6 +117,8 @@ fn fetchThenResume(self: *RobotsGate, robots_url: [:0]const u8, transfer: *Trans
         .loader_id = transfer.req.loader_id,
         .notification = transfer.req.notification,
         .origin = null,
+        .credentials_mode = .omit,
+        .request_mode = .no_cors,
         .ctx = robots_ctx,
         .header_callback = RobotsContext.headerCallback,
         .data_callback = RobotsContext.dataCallback,