diff --git a/docs/example.nginx.conf b/docs/example.nginx.conf
index 16a26872c..ebf6f2dc6 100644
--- a/docs/example.nginx.conf
+++ b/docs/example.nginx.conf
@@ -82,6 +82,7 @@ server {
     add_header X-XSS-Protection "1; mode=block";
     add_header X-Content-Type-Options nosniff;
     add_header Access-Control-Allow-Origin "${allowed_origins}";
+    add_header Access-Control-Allow-Credentials true;
     # add_header X-Frame-Options "SAMEORIGIN";
 
     # Opt out of Google's FLoC Network
@@ -219,6 +220,7 @@ server {
     location ^~ /blob/ {
         if ($request_method = 'OPTIONS') {
             add_header 'Access-Control-Allow-Origin' "${allowed_origins}";
+            add_header 'Access-Control-Allow-Credentials' true;
             add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
             add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
             add_header 'Access-Control-Max-Age' 1728000;
@@ -229,6 +231,7 @@ server {
         add_header X-Content-Type-Options nosniff;
         add_header Cache-Control max-age=31536000;
         add_header 'Access-Control-Allow-Origin' "${allowed_origins}";
+        add_header 'Access-Control-Allow-Credentials' true;
         add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
         add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Content-Length';
         add_header 'Access-Control-Expose-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Content-Length';
diff --git a/www/common/media-tag.js b/www/common/media-tag.js
index 264fbb462..f05b39d9a 100644
--- a/www/common/media-tag.js
+++ b/www/common/media-tag.js
@@ -244,6 +244,7 @@ var factory = function () {
         var check = function () {
             var xhr = new XMLHttpRequest();
             xhr.open("HEAD", src);
+            xhr.withCredentials = true;
             xhr.onerror = function () { return void cb("XHR_ERROR"); };
             xhr.onreadystatechange = function() {
                 if (this.readyState === this.DONE) {
@@ -276,6 +277,7 @@ var factory = function () {
         var fetch = function () {
             var xhr = new XMLHttpRequest();
             xhr.open('GET', src, true);
+            xhr.withCredentials = true;
             xhr.responseType = 'arraybuffer';
 
             var progress = function (offset) {
@@ -387,6 +389,7 @@ var factory = function () {
         var fetch = function () {
             var xhr = new XMLHttpRequest();
             xhr.open('GET', src, true);
+            xhr.withCredentials = true;
             xhr.setRequestHeader('Range', 'bytes=0-1');
             xhr.responseType = 'arraybuffer';
 
@@ -399,6 +402,7 @@ var factory = function () {
                 var xhr2 = new XMLHttpRequest();
 
                 xhr2.open("GET", src, true);
+                xhr2.withCredentials = true;
                 xhr2.setRequestHeader('Range', 'bytes=2-' + (size + 2));
                 xhr2.responseType = 'arraybuffer';
                 xhr2.onload = function () {