something I'm struggling to understand about browser security is why you can send cross-origin POST requests with the user's cookies with a form, but the exact same fetch() call won't include the cookies
(I mean it's clear why we would NOT want to include the cookies, but it feels weird that it's allowed in one context but not in another)
@b0rk Yeah, forms were introduced in HTML 2.0 in 1995. Javascript also came out in 1995, but wasn't really nailed down as a cross-browser spec until 1997.
Up to that point, JS couldn't really do anything fetch-like without a lot of gymnastics. That is, you could send data as query string parameters (commonly for transparent img elements), but it was really hard to get any meaningful data back from that response. It was possible via AJAX (Asynchronous Javascript + XML), commonly via iframe, but not in any way beginner-friendly, nor did it lend itself to 1-liners. It was very brute-force: you dynamically add a script to the DOM, and when the fetched JS ran it then talked to some window variable you'd set up to receive the data.
This was when you really started seeing cross-domain concerns.
In 1999, along came XMLHttpRequest, introduced by MS for Internet Explorer. You wouldn't see fetch until EcmaScript 7 in 2016. They have similar functionality, but vastly improved usability for the latter.
Julia Evans
Rick Osborne