Ensure requests use 'cors' mode on browsers (#409)

src/contentFetcher.ts

@@ -248,6 +248,13 @@ export class ContentFetcher {
         }
 
         return fetch(dynamic ? this.dynamicEndpoint : this.staticEndpoint, {
+            // Set the request mode to 'cors' when running in the browser.
+            // By default, the request mode is computed based on the referrer policy
+            // and response-tainting rules applied to the script that ultimately
+            // initiated the fetch, make this prone to errors due to unrelated
+            // configurations on the page.
+            // https://fetch.spec.whatwg.org/#origin-header
+            mode: typeof window === 'undefined' ? undefined : 'cors',
             credentials: 'omit',
             ...options.extra,
             method: 'POST',

src/evaluator.ts

@@ -276,6 +276,13 @@ export class Evaluator {
         }
 
         return fetch(this.endpoint, {
+            // Set the request mode to 'cors' when running in the browser.
+            // By default, the request mode is computed based on the referrer policy
+            // and response-tainting rules applied to the script that ultimately
+            // initiated the fetch, make this prone to errors due to unrelated
+            // configurations on the page.
+            // https://fetch.spec.whatwg.org/#origin-header
+            mode: typeof window === 'undefined' ? undefined : 'cors',
             credentials: 'omit',
             ...options.extra,
             method: 'POST',

test/contentFetcher.test.ts

@@ -33,6 +33,7 @@ describe('A content fetcher', () => {
     };
 
     const requestMatcher: MockOptions = {
+        functionMatcher: (_, req) => req.mode === 'cors',
         method: 'POST',
         headers: {
             'Content-Type': 'application/json',

test/evaluator.test.ts

@@ -36,6 +36,7 @@ describe('An evaluator', () => {
 
     const query = 'user\'s name';
     const requestMatcher: MockOptions = {
+        functionMatcher: (_, req) => req.mode === 'cors',
         method: 'POST',
         headers: {
             'Content-Type': 'application/json',