It does work. Thank you.

I want to permit user delete his files by calling api.
I saw that request included cookie. But the response was 403.

-> How to delete file using api?

Code here:

function deleteFiles(file_urls) {
		return Promise.all(file_urls.map(f => {
			var http = new XMLHttpRequest();
			var url = window.location.origin + '/api/v3/files';
			http.open('DELETE', url, true);

			//Send the proper header information along with the request
			http.setRequestHeader('Content-type', 'application/x-www-form-urlencoded');

			http.onreadystatechange = function() {//Call a function when the state changes.
				if(http.readyState == 4 && http.status == 200) {
					alert(http.responseText);
				}
			}
			http.send({
				path: f
			});
		}))
	}