From 1699e6dedb0216bab920ee13d28fe941d7ccc494 Mon Sep 17 00:00:00 2001
From: Juanfran <juanfran.ag@gmail.com>
Date: Mon, 3 Jun 2024 12:02:51 +0200
Subject: [PATCH] fix(runtime): prevent use api credentials

---
 libs/plugins-runtime/src/lib/load-plugin.ts | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/libs/plugins-runtime/src/lib/load-plugin.ts b/libs/plugins-runtime/src/lib/load-plugin.ts
index 05c596b..305ad43 100644
--- a/libs/plugins-runtime/src/lib/load-plugin.ts
+++ b/libs/plugins-runtime/src/lib/load-plugin.ts
@@ -35,7 +35,14 @@ export const ɵloadPlugin = async function (manifest: Manifest) {
 
       const c = new Compartment({
         penpot: harden(pluginApi),
-        fetch: window.fetch.bind(window),
+        fetch: harden((...args: Parameters<typeof fetch>) => {
+          const requestArgs: RequestInit = {
+            ...args[1],
+            credentials: 'omit',
+          };
+
+          return fetch(args[0], requestArgs);
+        }),
         console: harden(window.console),
         Math: harden(Math),
         setTimeout: harden(