Cross-Origin Credentials

(function() {
 new MultipleUpload('#demo', {
 uploadUrl: '/api/upload',
 multiple: true,
 withCredentials: true
 });
})();

What this actually switches on

withCredentials defaults to false, which means a cross-origin upload sends no cookies and no HTTP-auth header even if the user is signed in on that domain. Setting it true sets xhr.withCredentials on the upload request and credentials: 'include' on the fetch calls the component makes, so the session travels with the bytes.

The server has to agree

This is the half people miss: the browser discards a credentialed cross-origin response unless the server answers with Access-Control-Allow-Credentials: true, and Access-Control-Allow-Origin set to your exact origin. A wildcard * is rejected outright once credentials are involved. The symptom is a CORS error on a request that plainly succeeded in the network panel.