From be69e8411f614bd1aff7802a88609d533090bb00 Mon Sep 17 00:00:00 2001
From: Tsachi Shlidor <tsachi.shlidor@cloudinary.com>
Date: Mon, 6 Apr 2026 12:02:55 +0300
Subject: [PATCH 1/2] fix: apply credentials config on vtt-from-url

---
 src/plugins/cloudinary/index.js             |  1 +
 src/plugins/text-tracks-manager/index.js    |  1 +
 src/plugins/text-tracks-manager/utils.js    |  5 +--
 test/unit/text-tracks-manager-utils.test.js | 37 +++++++++++++++++++++
 4 files changed, 42 insertions(+), 2 deletions(-)
 create mode 100644 test/unit/text-tracks-manager-utils.test.js

diff --git a/src/plugins/cloudinary/index.js b/src/plugins/cloudinary/index.js
index eb3e4df5c..b6062bffc 100644
--- a/src/plugins/cloudinary/index.js
+++ b/src/plugins/cloudinary/index.js
@@ -384,6 +384,7 @@ class CloudinaryContext {
         }
         return srcs;
       }, []);
+      this.player.crossOrigin(src.withCredentials ? 'use-credentials' : null);
       this.player.src(_sources);
 
       _lastSource = src;
diff --git a/src/plugins/text-tracks-manager/index.js b/src/plugins/text-tracks-manager/index.js
index afa63c367..2a0a8b4eb 100644
--- a/src/plugins/text-tracks-manager/index.js
+++ b/src/plugins/text-tracks-manager/index.js
@@ -126,6 +126,7 @@ function textTracksManager() {
         sourceUrl,
         {
           signal,
+          credentials: player.cloudinary.source?.().withCredentials ? 'include' : 'omit',
           polling: type === 'transcript' && !src,
           interval: 2000,
           maxAttempts: 10,
diff --git a/src/plugins/text-tracks-manager/utils.js b/src/plugins/text-tracks-manager/utils.js
index cd5bc6401..b8e778f74 100644
--- a/src/plugins/text-tracks-manager/utils.js
+++ b/src/plugins/text-tracks-manager/utils.js
@@ -9,7 +9,8 @@ export const fetchFileContent = async (
     signal,
     onSuccess,
     onError,
-    onAttempt
+    onAttempt,
+    credentials = 'omit',
   } = config;
 
   let attempts = 0;
@@ -22,7 +23,7 @@ export const fetchFileContent = async (
     attempts++;
     onAttempt?.(attempts);
 
-    const response = await fetch(url, { signal });
+    const response = await fetch(url, { signal, credentials });
 
     if (response.status === 202 && polling) {
       if (attempts < maxAttempts) {
diff --git a/test/unit/text-tracks-manager-utils.test.js b/test/unit/text-tracks-manager-utils.test.js
new file mode 100644
index 000000000..d63dcfb65
--- /dev/null
+++ b/test/unit/text-tracks-manager-utils.test.js
@@ -0,0 +1,37 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { fetchFileContent } from '../../src/plugins/text-tracks-manager/utils.js';
+
+describe('text-tracks-manager utils fetchFileContent', () => {
+  beforeEach(() => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(() =>
+        Promise.resolve({
+          ok: true,
+          status: 200,
+          text: () => Promise.resolve('WEBVTT\n\n'),
+        })
+      )
+    );
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it('uses credentials omit when not specified', async () => {
+    await fetchFileContent('https://example.com/captions.srt');
+    expect(fetch).toHaveBeenCalledWith('https://example.com/captions.srt', {
+      signal: undefined,
+      credentials: 'omit',
+    });
+  });
+
+  it('uses credentials include when configured', async () => {
+    await fetchFileContent('https://example.com/captions.srt', { credentials: 'include' });
+    expect(fetch).toHaveBeenCalledWith('https://example.com/captions.srt', {
+      signal: undefined,
+      credentials: 'include',
+    });
+  });
+});

From a19517ab8ccf6c5b6ec08bfe6e1b1df693efeeae Mon Sep 17 00:00:00 2001
From: Tsachi Shlidor <tsachi.shlidor@cloudinary.com>
Date: Mon, 6 Apr 2026 13:34:37 +0300
Subject: [PATCH 2/2] chore: fix e2e

---
 src/plugins/cloudinary/index.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/plugins/cloudinary/index.js b/src/plugins/cloudinary/index.js
index b6062bffc..1a65ead36 100644
--- a/src/plugins/cloudinary/index.js
+++ b/src/plugins/cloudinary/index.js
@@ -384,7 +384,9 @@ class CloudinaryContext {
         }
         return srcs;
       }, []);
-      this.player.crossOrigin(src.withCredentials ? 'use-credentials' : null);
+      if (src.withCredentials) {
+        this.player.crossOrigin('use-credentials');
+      }
       this.player.src(_sources);
 
       _lastSource = src;