[HTTP] Fetch client certificates workaround

[chrisdavidmills]

Acceptance criteria

1. • The listed features are documented sufficiently on MDN
2. • BCD is updated
3. • Interactive example and data repos are updated if appropriate
4. • The content has been reviewed as needed

Features to document

1. Add a preference to enable sending client certificates when Fetch's credentials mode would exclude them, even though the spec says not to

Related Gecko bugs

1. • Add a preference to enable sending client certificates when Fetch's credentials mode would exclude them, even though the spec says not to. This is an interesting one — kind of a weird spec bug workaround. This probably needs a rel note, plus a useful note explaining this on a few pages (e.g. Fetch credentials property page, CORS, etc.)

For folks helping with Firefox-related documentation features — make sure above AC have been done, but also:

• Set bugs to dev-doc-complete
• Add entry to Firefox release notes if feature is enabled in release
• Add entry to Firefox experimental features page if feature is not yet enabled in release

[hamishwillee]

Overview of what needs to be done following review:

• Add release note - done in FF87 Preference for credentials in CORS preflight request #2558
• Add dev-doc-complete
• BCD - Not required
• Interactive example - note required
• Docs updates
• • Cross-Origin Resource Sharing (CORS) > Requests with credentials
  • Added section in FF87 Preference for credentials in CORS preflight request #2558 on preflight requests with credentials.
  • This has info about the preference too.
• • Tidy up Using Fetch > Sending a request with credentials included.
  • Basically just notes that browsers "should not" send credentials in preflight request and links to CORS doc for info on exception cases/preference.
• • Using XMLHttpRequest - not sure about this one. It says nothing much about use cross-site other than to point to CORS doc. I think that is probably the right thing to do there unles we want to pull in info from the CORS doc on how this is used ... which seems silly. So marking this as DONE meaning I don't plan to do anything for this.

Note also that bugzillla 1019603 indicates that in future release this might flip over to default enabled rather than default disabled.

@chrisdavidmills Generally I think that this should not be mentioned "everywhere". Rather it should be mentioned in a new section in the CORS doc. Other sections about credentials that might be affected should link to the relevant CORS docs. The reason is that even though this is a fetch spec "thing" it is an explicit override of CORS by that spec. Also because this is deviant/exceptional behaviour for a few sites - people still shouldn't expect it so it doesn't make sense to highlight everywhere.