Summary: iOS 11 and 10 have a native window.fetch implementation, but they do not have credentials: 'same-origin' as the new default

This is not necessarily a browser bug. This is the original ticket in webkit's bugzilla tracker, "Make fetch() use "same-origin" credentials by default" https://bugs.webkit.org/show_bug.cgi?id=176023

It's fixed in iOS 12, and I'm assuming Apple isn't going to be updating iOS 11 and 10.

Basically, to account for iOS 11 and 10, developers need to ensure they pass credentials: 'same-origin' to all fetch calls which require cookies/auth (api's that return unique data from user's account, assuming they are logged in).

In leu of explaining everything in full depth, I think the best way to fix this would be with extremely specific UA detection, basically only checking for iOS 11 and 10, and if a UA appears to be iOS 11/10, running some code like this:

window.outdatedNativeFetch = window.fetch;
window.fetch = (url, opts) => window.outdatedNativeFetch(url, {...opts, credentials: 'same-origin'})

Of course, we could also just force the polyfill, if we fear there's more issues with iOS 11+10