feat(symfony,laravel): withCredentials option to Swagger UI

[cay89]

Q	A
Branch?	main
Tickets
License	MIT
Doc PR	api-platform/docs#2285

Problem

When an API Platform Laravel application is deployed behind Cloudflare Access, the Swagger UI's token and CORS requests are intercepted and rejected with a 401 response. This happens because the Cloudflare Access authentication cookie is not forwarded with these requests — browsers only include cookies in cross-origin requests when credentials: 'include' is explicitly set.

Solution

This PR adds a withCredentials boolean option to OpenApi\Options. When enabled, a requestInterceptor is injected into the SwaggerUIBundle configuration that sets credentials: 'include' on every outgoing request, ensuring the Cloudflare Access cookie is forwarded.

The option is disabled by default to preserve existing behaviour.

Changes

• src/OpenApi/Options.php — new withCredentials constructor parameter (default false) and getWithCredentials() getter
• src/Laravel/ApiPlatformProvider.php — reads swagger_ui.with_credentials from config and passes it to Options
• src/Laravel/State/SwaggerUiProcessor.php — includes withCredentials in the swagger-data JSON payload
• src/Laravel/public/init-swagger-ui.js — conditionally adds a requestInterceptor that sets req.credentials = 'include'
• src/Laravel/config/api-platform.php — documents the new with_credentials config key (disabled by default)

Configuration

// config/api-platform.php
'swagger_ui' => [
    'with_credentials' => true,
],

Testing

• Added Tests/DocsWithCredentialsTest.php — integration test verifying that "withCredentials":true is present in the rendered swagger-data JSON when the option is enabled, and absent by default.

[soyuka]

thanks!