Networking docs appear outdated: credentials: 'omit' works on RN 0.86

Summary

The Networking docs list credentials: 'omit' as currently not working with fetch:

https://reactnative.dev/docs/network#known-issues-with-fetch-and-cookie-based-authentication

On React Native 0.86, the built-in global fetch respects credentials: 'omit' in all cookie scenarios tested on both iOS and Android:

• existing cookies are not sent on direct requests;
• existing cookies are not sent after an automatically followed 302;
• Set-Cookie from a direct response is not persisted;
• Set-Cookie from a 302 response is neither sent to the redirected request nor persisted.

Equivalent credentials: 'include' controls all behave in the opposite way, confirming that the cookie store and test server are working.

The other documented limitation, redirect: 'manual', is outside the scope of this report.

Environment

• react-native package: 0.86.2
• Native runtime reported by Platform.constants.reactNativeVersion: 0.86.0
• Expo: 57.0.9, Expo Go
• iOS: 26.5 simulator
• Android: API 37 emulator
• Fetch implementation: React Native built-in global fetch
  • EXPO_PUBLIC_USE_RN_FETCH=1
  • confirmed global fetch !== expo/fetch

Expo SDK 57 documents EXPO_PUBLIC_USE_RN_FETCH=1 as the switch that keeps React Native's built-in fetch as the global implementation:

https://docs.expo.dev/versions/v57.0.0/sdk/expo/#expofetch-api

Reproduction

The test server provides these endpoints:

• /api/set-cookie — responds with Set-Cookie: session=abc123 and theme=dark;
• /api/cookies — returns the received Cookie header;
• /api/redirect-to-cookies — 302 to /api/cookies;
• /api/redirect-set-cookie — responds with both 302 and Set-Cookie, redirecting to /api/cookies;
• /api/clear-test-cookies — expires all cookies used by the test.

The relevant client checks are equivalent to:

// Existing cookies: direct requests and automatic 302 follow
await clearTestCookies();
await fetch(`${API}/api/set-cookie`, { credentials: 'include' });

assert((await readCookies('include')).cookieHeader ===
  'session=abc123; theme=dark');
assert((await readCookies('omit')).cookieHeader === null);

assert((await fetchRedirect('include')).cookieHeader ===
  'session=abc123; theme=dark');
assert((await fetchRedirect('omit')).cookieHeader === null);

// A direct Set-Cookie response must be ignored with omit
await clearTestCookies();
await fetch(`${API}/api/set-cookie?scenario=direct-omit-response`, {
  credentials: 'omit',
});
assert((await readCookies('include')).cookieHeader === null);

// Control: the same operation with include persists the cookie
await clearTestCookies();
await fetch(`${API}/api/set-cookie?scenario=direct-include-response`, {
  credentials: 'include',
});
assert((await readCookies('include')).cookieHeader ===
  'direct_include_response=should_persist');

// Set-Cookie received on a 302 must also be ignored with omit
await clearTestCookies();
const redirectedOmit = await fetch(
  `${API}/api/redirect-set-cookie?scenario=redirect-omit-response`,
  { credentials: 'omit' },
);
assert((await redirectedOmit.json()).cookieHeader === null);
assert((await readCookies('include')).cookieHeader === null);

// Control: include sends the new cookie on the redirected request and persists it
await clearTestCookies();
const redirectedInclude = await fetch(
  `${API}/api/redirect-set-cookie?scenario=redirect-include-response`,
  { credentials: 'include' },
);
assert((await redirectedInclude.json()).cookieHeader ===
  'redirect_include_response=should_persist');
assert((await readCookies('include')).cookieHeader ===
  'redirect_include_response=should_persist');

Results

All 10/10 checks passed independently on each platform.

Behavior	Expected include control	Expected omit behavior	iOS	Android
Existing cookies, direct request	sent	not sent	PASS	PASS
Existing cookies, followed 302	sent	not sent	PASS	PASS
Direct response Set-Cookie	persisted	ignored	PASS	PASS
302 response Set-Cookie on redirected request	sent	not sent	PASS	PASS
302 response Set-Cookie after the request	persisted	ignored	PASS	PASS

Implementation context

The current request path also appears to implement this behavior explicitly:

• whatwg-fetch maps credentials: 'omit' to xhr.withCredentials = false:
  https://github.com/JakeChampion/fetch/blob/v3.6.20/fetch.js#L587-L591
• Android replaces the request client's cookie jar with CookieJar.NO_COOKIES when withCredentials is false:
  https://github.com/facebook/react-native/blob/v0.86.0/packages/react-native/ReactAndroid/src/main/java/com/facebook/react/modules/network/NetworkingModule.kt#L367-L373
• iOS sets HTTPShouldHandleCookies from withCredentials:
  https://github.com/facebook/react-native/blob/v0.86.0/packages/react-native/Libraries/Network/RCTNetworking.mm#L316-L324

The native withCredentials wiring landed in 2017 (iOS, Android); the current Known Issues text was added later in react-native-website#769 in 2019. This history alone does not establish which edge cases were broken in 2019, but the unconditional wording does not match the current tested behavior.

Related older reports describe omit failing rather than the documentation being stale: #12956 and #30885. Neither documents a current remaining failure mode.

Request

Please remove credentials: 'omit' from the list of unsupported options in the current / 0.86 Networking docs. If a specific remaining edge case is known, please narrow the warning to that platform, version, or scenario and link the corresponding report.

Bắt đầu với phần tài liệu Networking được liên kết trong báo cáo, đặc biệt là nội dung về các vấn đề đã biết đối với fetch và xác thực dựa trên cookie. Cập nhật nhận định về thông tin xác thực: «omit» để phù hợp với hành vi được báo cáo của React Native 0.86, đồng thời để giới hạn redirect: 'manual' ngoài phạm vi; công việc được xem là hoàn tất khi cảnh báo đã lỗi thời được xóa bỏ hoặc thu hẹp một cách phù hợp.