💥 By default, do not set credentials in fetch (#475)

Follow up to #248 

See #469

Do not pass `credentials` to `fetch` unless explicitly requrested.

cc @WalshyDev for visibility

Author: coyotte508

packages/inference/src/lib/makeRequestOptions.ts

@@ -89,19 +89,14 @@ export async function makeRequestOptions(
 		return `${HF_INFERENCE_API_BASE_URL}/models/${model}`;
 	})();
 
-	// Let users configure credentials, or disable them all together (or keep default behavior).
-	// ---
-	// This used to be an internal property only and never exposed to users. This means that most usages will never define this value
-	// So in order to make this backwards compatible, if it's undefined we go to "same-origin" (default behaviour before).
-	// If it's a boolean and set to true then set to "include". If false, don't define credentials at all (useful for edge runtimes)
-	// Then finally, if it's a string, use it as-is.
+	/**
+	 * For edge runtimes, leave 'credentials' undefined, otherwise cloudflare workers will error
+	 */
 	let credentials: RequestCredentials | undefined;
 	if (typeof includeCredentials === "string") {
 		credentials = includeCredentials as RequestCredentials;
-	} else if (typeof includeCredentials === "boolean") {
-		credentials = includeCredentials ? "include" : undefined;
-	} else if (includeCredentials === undefined) {
-		credentials = "same-origin";
+	} else if (includeCredentials === true) {
+		credentials = "include";
 	}
 
 	const info: RequestInit = {
@@ -113,7 +108,7 @@ export async function makeRequestOptions(
 					...otherArgs,
 					options: options && otherOptions,
 			  }),
-		credentials,
+		...(credentials && { credentials }),
 		signal: options?.signal,
 	};
 

packages/inference/src/types.ts

@@ -32,7 +32,7 @@ export interface Options {
 	signal?: AbortSignal;
 
 	/**
-	 * (Default: "same-origin"). String | Boolean. Credentials to use for the request. If this is a string, it will be passed straight on. If it's a boolean, true will be "include" and false will not send credentials at all.
+	 * Credentials to use for the request. If this is a string, it will be passed straight on. If it's a boolean, true will be "include" and false will not send credentials at all (which defaults to "same-origin" inside browsers).
 	 */
 	includeCredentials?: string | boolean;
 }