Why are cookies missing on cross-origin fetch calls?

The answer

By default, MDN explains, credentials such as cookies are only included in same-origin fetch requests. For a cross-origin call you must opt in with the credentials option set to include, and the server must reply with Access-Control-Allow-Credentials: true and a specific origin in Access-Control-Allow-Origin, because a wildcard is not accepted with credentials. If either side is missing, the browser leaves out the cookie or ignores the response's Set-Cookie.