From 2591fa6bd950881a3ee45a59ab2b55dc83dfcf37 Mon Sep 17 00:00:00 2001
From: SkyZeroZx <73321943+SkyZeroZx@users.noreply.github.com>
Date: Wed, 22 Jul 2026 14:14:49 -0500
Subject: [PATCH] docs: clarify behavior of credentials option during SSR on
 Node.js

(cherry picked from commit 90ac011fa92d28d5b681998e60029e2ee6a2695a)
---
 adev/src/content/guide/http/making-requests.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/adev/src/content/guide/http/making-requests.md b/adev/src/content/guide/http/making-requests.md
index e6fab923c2e..8b388a35da0 100644
--- a/adev/src/content/guide/http/making-requests.md
+++ b/adev/src/content/guide/http/making-requests.md
@@ -531,6 +531,8 @@ Available `credentials` values:
 
 TIP: Use `credentials: 'include'` when you need to send authentication cookies or headers to a different domain that supports CORS. Avoid mixing `credentials` and `withCredentials` options to prevent confusion.
 
+IMPORTANT: During SSR on Node.js, `credentials: 'include'` does not automatically forward cookies from the incoming browser request. The `credentials` option does not remove `Cookie` or `Authorization` headers that you add explicitly. [Undici permits some headers that browsers forbid](https://undici.nodejs.org/#forbidden-and-safelisted-header-names), so only forward credential headers to trusted origins.
+
 #### Referrer
 
 The `referrer` option allows you to control what referrer information is sent with the request. This is important for privacy and security considerations.