     // Request a page that will send an HTTPOnly &#39;set-cookie&#39; response header with secret value.
      await fetch(`${baseURI}cookie?secret=${secret}_http`);
    }

read: async () =&gt; {
      // Test if we now send a requests with a &#39;cookie&#39; header containing the secret.
      let response = await fetch(`${baseURI}headers`);
      let cookie = (await response.json())[&quot;cookie&quot;];
      return cookie ? cookie.match(/secret=([\w-]+)/)[1]: null;
    }

result, same first party: c1358