fix: remove unnecessary path validation which breaks fetch with custom path base

.changeset/honest-cobras-jog.md

@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': major
+---
+
+fix: `fetch` not working when URL is same host but different than `paths.base`

packages/kit/src/runtime/server/fetch.js

@@ -55,7 +55,11 @@ export function create_fetch({ event, options, manifest, state, get_cookie_heade
 					request.headers.delete('origin');
 				}
 
-				if (url.origin !== event.url.origin) {
+				const decoded = decodeURIComponent(url.pathname);
+				if (
+					url.origin !== event.url.origin ||
+					(paths.base && !decoded.startsWith(`${paths.base}/`))
+				) {
 					// Allow cookie passthrough for "credentials: same-origin" and "credentials: include"
 					// if SvelteKit is serving my.domain.com:
 					// -        domain.com WILL NOT receive cookies
@@ -77,7 +81,6 @@ export function create_fetch({ event, options, manifest, state, get_cookie_heade
 				// handle fetch requests for static assets. e.g. prebaked data, etc.
 				// we need to support everything the browser's fetch supports
 				const prefix = paths.assets || paths.base;
-				const decoded = decodeURIComponent(url.pathname);
 				const filename = (
 					decoded.startsWith(prefix) ? decoded.slice(prefix.length) : decoded
 				).slice(1);

packages/kit/test/apps/options/source/pages/routing/link-outside-base/+page.server.js

@@ -0,0 +1,6 @@
+export async function load({ fetch }) {
+	const response = await fetch('/not-base-path/');
+	return {
+		fetchUrl: response.url
+	};
+}

packages/kit/test/apps/options/source/pages/routing/link-outside-base/+page.svelte

@@ -0,0 +1,6 @@
+<script>
+	/** @type {{ data: { fetchUrl: string } }} */
+	const { data } = $props();
+</script>
+
+<p data-testid="fetch-url">{data.fetchUrl}</p>

packages/kit/test/apps/options/test/test.js

@@ -236,6 +236,13 @@ test.describe('Routing', () => {
 		await page.click('[href="/path-base/routing/link-outside-app-target/target/"]');
 		await expect(page.locator('h2')).toHaveText('target: 0');
 	});
+
+	test('fetch outside base path succeeds', async ({ page, baseURL }) => {
+		await page.goto('/path-base/routing/link-outside-base/');
+		expect(await page.locator('p[data-testid="fetch-url"]').textContent()).toContain(
+			`${baseURL}/not-base-path/`
+		);
+	});
 });
 
 test.describe('Async', () => {