diff --git a/fetch.js b/fetch.js
index da703f2f..75c723c3 100644
--- a/fetch.js
+++ b/fetch.js
@@ -261,9 +261,6 @@
 
     return new Promise(function(resolve, reject) {
       var xhr = new XMLHttpRequest()
-      if (self.credentials === 'cors') {
-        xhr.withCredentials = true;
-      }
 
       function responseURL() {
         if ('responseURL' in xhr) {
@@ -300,6 +297,10 @@
 
       xhr.open(self.method, self.url, true)
 
+      if (self.credentials === 'cors') {
+        xhr.withCredentials = true;
+      }
+
       if ('responseType' in xhr && support.blob) {
         xhr.responseType = 'blob'
       }