On the one hand:

https://www.w3.org/TR/service-workers/#update-algorithm does not set the credentials mode of the worker script fetch explicitly, at least by my reading, so perhaps this is expected behavior?

On the other hand:

https://w3c.github.io/ServiceWorker/#update-algorithm
defers to
https://html.spec.whatwg.org/multipage/webappapis.html#fetch-a-classic-worker-script
for construction of the request object, and in that case credentials mode is "same-origin" and uses the (default) response tainting mode "basic", which combined should cause the Fetch to send cookies (I think.)

Jake: can you confirm the intended spec is to send credentials in register/update requests?

Credentials are actually sent, I was testing incorrectly before. Glad to see this works! :)

Remaining question: is this behavior per-spec? 

Credentials should be sent. As bsittler says, credentials are added via https://html.spec.whatwg.org/multipage/webappapis.html#fetch-a-classic-worker-script which sets credentials to be same-origin.

Great, working as intended then :)

Some WPT tests would be nice, though. :-)

Also add tests that Set-Cookie works.

This issue has been Available for over a year. If it's no longer important or seems unlikely to be fixed, please consider closing it out. If it is important, please re-triage the issue.

Sorry for the inconvenience if the bug really should have been left as Available.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot