gradio

461d82df - Use same-origin credentials in the JS client so cross-origin embeds work again (#13581)

Use same-origin credentials in the JS client so cross-origin embeds work again (#13581) * Use same-origin credentials in JS client Cross-origin embeds (<gradio-app>) broke after the Spaces reverse proxy stopped setting Access-Control-Allow-Credentials on cross-origin responses: every client request used credentials: "include", so the config fetch and queue/join were blocked by CORS. Switch all client requests to credentials: "same-origin" so embed requests go out uncredentialed and pass CORS, while same-origin app use still sends cookies (auth preserved) and the Authorization token path is unaffected. Also drop the Content-Type header from the body-less /config and api info GETs so they stay CORS-simple and avoid a preflight. Closes #13554 * add changeset * Add credentials option to the JS client Address review feedback on the same-origin switch: it silently breaks deployments that call a cookie-authenticated Gradio app from another origin (e.g. SSO session cookies with credentialed CORS configured). Add ClientOptions.credentials so such deployments can opt back in via Client.connect(url, { credentials: "include" }). All requests default to same-origin, keeping the cross-origin embed fix. The login POST in get_cookie_header takes the mode as an optional parameter since it is not client-bound. * Trim overlapping credentials tests Per review, the per-call-site request-shape tests repeated the same two behaviors. Keep one test for the same-origin default and missing Content-Type (the /config path) and one for the credentials opt-in; drop the duplicates in view_api and post_data. --------- Co-authored-by: gradio-pr-bot <gradio-pr-bot@users.noreply.github.com>