SharePoint JavaScript REST Api, how is the access token passed

Question

I have the following code in my SharePoint add-in (SharePoint Online). Simple code just to load the list items, the code works fine

    $.ajax({
        url: appweburl + "/_api/web/lists/getbytitle('MyList')/items",
        type: "GET",
        headers: { "Accept": "application/json;odata=verbose" },
        cache: false,
        success: function (data) {
            alert('Successfully obtained data.');
        },
        error: function (data) {
            alert(data);
        }
    });

My confusion is, I am not passing any access token and from what I know the access token is required to let the add-in access data. So how is this working?

Answer 1

The browser passes over the FedAuth cookie with the XHR request, and that authenticates you.