It currently isn't possible to make same-origin no-credentials requests for things that use the crossorigin attribute.
Notably, this means you can't <link rel="preload"> a fetch() or script module (unless you make the fetch/script send credentials).
A crossorigin attribute that changes same-origin behaviour is a bit weird, so maybe there needs to be some sort of fetchoptions attribute on everything that currently uses crossorigin.
+@yoavweiss @igrigorik
It currently isn't possible to make same-origin no-credentials requests for things that use the
crossoriginattribute.Notably, this means you can't
<link rel="preload">afetch()or script module (unless you make the fetch/script send credentials).A
crossoriginattribute that changes same-origin behaviour is a bit weird, so maybe there needs to be some sort offetchoptionsattribute on everything that currently usescrossorigin.+@yoavweiss @igrigorik