feat: configures the auto-generated fetch client from hey-api to include credentials by default

src/Umbraco.Web.UI.Client/src/external/openid/src/xhr.ts

@@ -35,6 +35,7 @@ export class FetchRequestor extends Requestor {
 		const requestInit: RequestInit = {};
 		requestInit.method = settings.method;
 		requestInit.mode = 'cors';
+		requestInit.credentials = settings.credentials ?? 'include';
 
 		if (settings.data) {
 			if (settings.method && settings.method.toUpperCase() === 'POST') {

src/Umbraco.Web.UI.Client/src/packages/core/auth/auth-flow.ts

@@ -361,6 +361,7 @@ export class UmbAuthFlow {
 		const token = await this.performWithFreshTokens();
 		const request = new Request(this.#unlink_endpoint, {
 			method: 'POST',
+			credentials: 'include',
 			headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
 			body: JSON.stringify({ loginProvider, providerKey }),
 		});
@@ -454,6 +455,7 @@ export class UmbAuthFlow {
 		const token = await this.performWithFreshTokens();
 
 		const request = await fetch(`${this.#link_key_endpoint}?provider=${provider}`, {
+			credentials: 'include',
 			headers: {
 				Authorization: `Bearer ${token}`,
 				'Content-Type': 'application/json',

src/Umbraco.Web.UI.Client/src/packages/core/http-client/index.ts

@@ -1 +1,14 @@
-export { client as umbHttpClient } from '@umbraco-cms/backoffice/external/backend-api';
+import { client } from '@umbraco-cms/backoffice/external/backend-api';
+
+/**
+ * Pre-configure the client with default credentials for cookie-based authentication.
+ * This ensures all requests include cookies by default, which is required for
+ * cookie-based authentication in Umbraco 17.0+.
+ *
+ * Extensions using this client will automatically get credentials: 'include'.
+ */
+client.setConfig({
+	credentials: 'include',
+});
+
+export { client as umbHttpClient };

src/Umbraco.Web.UI.Client/src/packages/core/resources/try-execute/tryXhrRequest.function.ts

@@ -44,6 +44,7 @@ function createXhrRequest<T>(options: XhrRequestOptions): UmbCancelablePromise<T
 	return new UmbCancelablePromise<T>(async (resolve, reject, onCancel) => {
 		const xhr = new XMLHttpRequest();
 		xhr.open(options.method, `${baseUrl}${options.url}`, true);
+		xhr.withCredentials = options.withCredentials ?? true;
 
 		// Set default headers
 		if (options.token) {

src/Umbraco.Web.UI.Client/src/packages/core/resources/types.ts

@@ -7,6 +7,7 @@ export interface XhrRequestOptions extends UmbTryExecuteOptions {
 	baseUrl?: string;
 	method: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'HEAD' | 'OPTIONS';
 	url: string;
+	withCredentials?: boolean;
 	body?: unknown;
 	token?: string | (() => undefined | string | Promise<string | undefined>);
 	headers?: Record<string, string>;

src/Umbraco.Web.UI.Client/src/packages/documents/documents/user-permissions/document/repository/document-permission.server.data.ts

@@ -22,6 +22,7 @@ export class UmbDocumentPermissionServerDataSource {
 			this.#host,
 			fetch(`/umbraco/management/api/v1/document/${id}/permissions`, {
 				method: 'GET',
+				credentials: 'include',
 				headers: {
 					'Content-Type': 'application/json',
 				},