Remove Client build and restore targets from CSPROJ in template

.github/BUILD.md

@@ -37,7 +37,7 @@ In order to work with the Umbraco source code locally, first make sure you have
 
 ### Familiarizing yourself with the code
 
-Umbraco is a .NET application using C#. The solution is broken down into multiple projects.  There are several class libraries. The `Umbraco.Web.UI` project is the main project that hosts the back office and login screen. This is the project you will want to run to see your changes.
+Umbraco is a .NET application using C#. The solution is broken down into multiple projects. There are several class libraries. The `Umbraco.Web.UI` project is the main project that hosts the back office and login screen. This is the project you will want to run to see your changes.
 
 There are two web projects in the solution with client-side assets based on TypeScript, `Umbraco.Web.UI.Client` and `Umbraco.Web.UI.Login`.
 
@@ -73,13 +73,20 @@ Just be careful not to include this change in your PR.
 
 Conversely, if you are working on front-end only, you want to build the back-end once and then run it. Before you do so, update the configuration in `appSettings.json` to add the following under `Umbraco:Cms:Security`:
 
-```
+```json
 "BackOfficeHost": "http://localhost:5173",
 "AuthorizeCallbackPathName": "/oauth_complete",
 "AuthorizeCallbackLogoutPathName": "/logout",
-"AuthorizeCallbackErrorPathName": "/error"
+"AuthorizeCallbackErrorPathName": "/error",
+"BackOfficeTokenCookie": {
+  "Enabled": true,
+  "SameSite": "None"
+}
 ```
 
+> [!NOTE]
+> If you get stuck in a login loop, try clearing your browser cookies for localhost, and make sure that the `BackOfficeTokenCookie` settings are correct. Namely, that `SameSite` should be set to `None` when running the front-end server separately.
+
 Then run Umbraco from the command line.
 
 ```

.github/README.md

@@ -38,6 +38,14 @@ Some important documentation links to get you started:
 - [Getting to know Umbraco](https://docs.umbraco.com/umbraco-cms/fundamentals/get-to-know-umbraco)
 - [Tutorials for creating a basic website and customizing the editing experience](https://docs.umbraco.com/umbraco-cms/tutorials/overview)
 
+## Backoffice Preview
+
+Want to see the latest backoffice UI in action? Check out our live preview:
+
+**[backofficepreview.umbraco.com](https://backofficepreview.umbraco.com/)**
+
+This preview is automatically deployed from the main branch and showcases the latest backoffice features and improvements.  It runs from mock data and persistent edits are not supported.
+
 ## Get help
 
 If you need a bit of feedback while building your Umbraco projects, we are [chatty on Discord](https://discord.umbraco.com). Our Discord server serves as a social space for all Umbracians. If you have any questions or need some help with a problem, head over to our [dedicated forum](https://forum.umbraco.com/) where the Umbraco Community will be happy to help. 

.github/copilot-instructions.md

@@ -94,19 +94,34 @@ The solution contains 30 C# projects organized as follows:
 
 ## Common Tasks
 
-### Frontend Development
-For frontend-only changes:
-1. Configure backend for frontend development:
-   ```json
-   <!-- Add to src/Umbraco.Web.UI/appsettings.json under Umbraco:Cms:Security: -->
+### Running Umbraco in Different Modes
+
+**Production Mode (Standard Development)**
+Use this for backend development, testing full builds, or when you don't need hot reloading:
+1. Build frontend assets: `cd src/Umbraco.Web.UI.Client && npm run build:for:cms`
+2. Run backend: `cd src/Umbraco.Web.UI && dotnet run --no-build`
+3. Access backoffice: `https://localhost:44339/umbraco`
+4. Application uses compiled frontend from `wwwroot/umbraco/backoffice/`
+
+**Vite Dev Server Mode (Frontend Development with Hot Reload)**
+Use this for frontend-only development with hot module reloading:
+1. Configure backend for frontend development - Add to `src/Umbraco.Web.UI/appsettings.json` under `Umbraco:CMS:Security`:
    ```json
    "BackOfficeHost": "http://localhost:5173",
    "AuthorizeCallbackPathName": "/oauth_complete",
    "AuthorizeCallbackLogoutPathName": "/logout",
-   "AuthorizeCallbackErrorPathName": "/error"
+   "AuthorizeCallbackErrorPathName": "/error",
+   "BackOfficeTokenCookie": {
+     "Enabled": true,
+     "SameSite": "None"
+   }
    ```
 2. Run backend: `cd src/Umbraco.Web.UI && dotnet run --no-build`
 3. Run frontend dev server: `cd src/Umbraco.Web.UI.Client && npm run dev:server`
+4. Access backoffice: `http://localhost:5173/` (no `/umbraco` prefix)
+5. Changes to TypeScript/Lit files hot reload automatically
+
+**Important:** Remove the `BackOfficeHost` configuration before committing or switching back to production mode.
 
 ### Backend-Only Development
 For backend-only changes, disable frontend builds:

.github/workflows/label-to-release-announcement.yml

@@ -52,7 +52,7 @@ jobs:
               for (const item of items) {
                 const releaseLabels = (item.labels || [])
                   .map(l => (typeof l === "string" ? l : l.name)) // always get the name
-                  .filter(n => typeof n === "string" && n.startsWith("release/"));
+                  .filter(n => typeof n === "string" && n.startsWith("release/") && n !== "release/no-notes");
                 if (releaseLabels.length === 0) continue;
 
                 core.info(`#${item.number}: ${releaseLabels.join(", ")}`);

.vscode/launch.json

@@ -101,10 +101,14 @@
       "env": {
         "ASPNETCORE_ENVIRONMENT": "Development",
         "ASPNETCORE_URLS": "https://localhost:44339",
+        "UMBRACO__CMS__WEBROUTING__UMBRACOAPPLICATIONURL": "https://localhost:44339",
         "UMBRACO__CMS__SECURITY__BACKOFFICEHOST": "http://localhost:5173",
         "UMBRACO__CMS__SECURITY__AUTHORIZECALLBACKPATHNAME": "/oauth_complete",
         "UMBRACO__CMS__SECURITY__AUTHORIZECALLBACKLOGOUTPATHNAME": "/logout",
-        "UMBRACO__CMS__SECURITY__AUTHORIZECALLBACKERRORPATHNAME": "/error"
+        "UMBRACO__CMS__SECURITY__AUTHORIZECALLBACKERRORPATHNAME": "/error",
+        "UMBRACO__CMS__SECURITY__KEEPUSERLOGGEDIN": "true",
+        "UMBRACO__CMS__SECURITY__BACKOFFICETOKENCOOKIE__ENABLED": "true",
+        "UMBRACO__CMS__SECURITY__BACKOFFICETOKENCOOKIE__SAMESITE": "None"
       },
       "sourceFileMap": {
         "/Views": "${workspaceFolder}/Umbraco.Web.UI/Views"

build/nightly-E2E-test-pipelines.yml

@@ -9,19 +9,19 @@ schedules:
     branches:
       include:
         - v15/dev
+        - v16/dev
         - main
-        - v17/dev
 
 parameters:
   - name: skipIntegrationTests
     displayName: Skip integration tests
     type: boolean
     default: false
 
-  - name: differentAppSettingsAcceptanceTests
-    displayName: Run acceptance tests with different app settings
+  - name: skipDifferentAppSettingsAcceptanceTests
+    displayName: Skip acceptance tests with different app settings
     type: boolean
-    default: true
+    default: false
 
   - name: skipDefaultConfigAcceptanceTests
     displayName: Skip tests with DefaultConfig
@@ -443,15 +443,15 @@ stages:
               vmImage: "ubuntu-latest"
               CONNECTIONSTRINGS__UMBRACODBDSN: "Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True"
             WindowsPart1Of3:
-              testCommand: "npm run test -- --shard=1/3"
+              testCommand: "npm run testWindows -- --shard=1/3"
               testFolder: "DefaultConfig"
               vmImage: "windows-latest"
             WindowsPart2Of3:
-              testCommand: "npm run test -- --shard=2/3"
+              testCommand: "npm run testWindows -- --shard=2/3"
               testFolder: "DefaultConfig"
               vmImage: "windows-latest"
             WindowsPart3Of3:
-              testCommand: "npm run test -- --shard=3/3"
+              testCommand: "npm run testWindows -- --shard=3/3"
               testFolder: "DefaultConfig"
               vmImage: "windows-latest"
         pool:
@@ -505,7 +505,7 @@ stages:
     jobs:
       - job:
         displayName: E2E Tests with Different App settings (SQL Server)
-        condition: ${{ eq(parameters.differentAppSettingsAcceptanceTests, true) }}
+        condition: ${{ eq(parameters.skipDifferentAppSettingsAcceptanceTests, false) }}
         timeoutInMinutes: 180
         variables:
           SA_PASSWORD: UmbracoAcceptance123!
@@ -564,6 +564,23 @@ stages:
               CONNECTIONSTRINGS__UMBRACODBDSN: Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True
               CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
               additionalEnvironmentVariables: false
+            # EntityDataPicker
+            WindowsEntityDataPicker:
+              vmImage: "windows-latest"
+              testFolder: "EntityDataPicker"
+              port: ''
+              testCommand: "npx playwright test --project=entityDataPicker"
+              CONNECTIONSTRINGS__UMBRACODBDSN: Data Source=(localdb)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\Umbraco.mdf;Integrated Security=True
+              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
+              additionalEnvironmentVariables: false
+            LinuxEntityDataPicker:
+              vmImage: "ubuntu-latest"
+              testFolder: "EntityDataPicker"
+              port: ''
+              testCommand: "npx playwright test --project=entityDataPicker"
+              CONNECTIONSTRINGS__UMBRACODBDSN: Server=(local);Database=Umbraco;User Id=sa;Password=$(SA_PASSWORD);Encrypt=True;TrustServerCertificate=True
+              CONNECTIONSTRINGS__UMBRACODBDSN_PROVIDERNAME: Microsoft.Data.SqlClient
+              additionalEnvironmentVariables: false
         pool:
           vmImage: $(vmImage)
         steps:
@@ -695,4 +712,4 @@ stages:
                 --data "$PAYLOAD" \
                 "$SLACK_WEBHOOK_URL"
             env:
-              SLACK_WEBHOOK_URL: $(E2ESLACKWEBHOOKURL)
+              SLACK_WEBHOOK_URL: $(E2ESLACKWEBHOOKURL)

src/Umbraco.Cms.Api.Common/DependencyInjection/HideBackOfficeTokensHandler.cs

@@ -0,0 +1,187 @@
+using System.Diagnostics.CodeAnalysis;
+using Microsoft.AspNetCore.DataProtection;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Options;
+using OpenIddict.Server;
+using OpenIddict.Validation;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Configuration.Models;
+using Umbraco.Cms.Core.Events;
+using Umbraco.Cms.Core.Notifications;
+using Umbraco.Cms.Web.Common.Security;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Common.DependencyInjection;
+
+internal sealed class HideBackOfficeTokensHandler
+    : IOpenIddictServerHandler<OpenIddictServerEvents.ApplyTokenResponseContext>,
+        IOpenIddictServerHandler<OpenIddictServerEvents.ExtractTokenRequestContext>,
+        IOpenIddictValidationHandler<OpenIddictValidationEvents.ProcessAuthenticationContext>,
+        INotificationHandler<UserLogoutSuccessNotification>
+{
+    private const string RedactedTokenValue = "[redacted]";
+    private const string AccessTokenCookieKey = "__Host-umbAccessToken";
+    private const string RefreshTokenCookieKey = "__Host-umbRefreshToken";
+
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly IDataProtectionProvider _dataProtectionProvider;
+    private readonly BackOfficeTokenCookieSettings _backOfficeTokenCookieSettings;
+    private readonly GlobalSettings _globalSettings;
+
+    public HideBackOfficeTokensHandler(
+        IHttpContextAccessor httpContextAccessor,
+        IDataProtectionProvider dataProtectionProvider,
+        IOptions<BackOfficeTokenCookieSettings> backOfficeTokenCookieSettings,
+        IOptions<GlobalSettings> globalSettings)
+    {
+        _httpContextAccessor = httpContextAccessor;
+        _dataProtectionProvider = dataProtectionProvider;
+        _backOfficeTokenCookieSettings = backOfficeTokenCookieSettings.Value;
+        _globalSettings = globalSettings.Value;
+    }
+
+    /// <summary>
+    /// This is invoked when tokens (access and refresh tokens) are issued to a client. For the back-office client,
+    /// we will intercept the response, write the tokens from the response into HTTP-only cookies, and redact the
+    /// tokens from the response, so they are not exposed to the client.
+    /// </summary>
+    public ValueTask HandleAsync(OpenIddictServerEvents.ApplyTokenResponseContext context)
+    {
+        if (context.Request?.ClientId is not Constants.OAuthClientIds.BackOffice)
+        {
+            // Only ever handle the back-office client.
+            return ValueTask.CompletedTask;
+        }
+
+        HttpContext httpContext = GetHttpContext();
+
+        if (context.Response.AccessToken is not null)
+        {
+            SetCookie(httpContext, AccessTokenCookieKey, context.Response.AccessToken);
+            context.Response.AccessToken = RedactedTokenValue;
+        }
+
+        if (context.Response.RefreshToken is not null)
+        {
+            SetCookie(httpContext, RefreshTokenCookieKey, context.Response.RefreshToken);
+            context.Response.RefreshToken = RedactedTokenValue;
+        }
+
+        return ValueTask.CompletedTask;
+    }
+
+    /// <summary>
+    /// This is invoked when requesting new tokens.
+    /// </summary>
+    public ValueTask HandleAsync(OpenIddictServerEvents.ExtractTokenRequestContext context)
+    {
+        if (context.Request?.ClientId != Constants.OAuthClientIds.BackOffice)
+        {
+            // Only ever handle the back-office client.
+            return ValueTask.CompletedTask;
+        }
+
+        // For the back-office client, this only happens when a refresh token is being exchanged for a new access token.
+        if (context.Request.RefreshToken == RedactedTokenValue
+            && TryGetCookie(RefreshTokenCookieKey, out var refreshToken))
+        {
+            context.Request.RefreshToken = refreshToken;
+        }
+        else
+        {
+            // If we got here, either the refresh token was not redacted, or nothing was found in the refresh token cookie.
+            // If OpenIddict found a refresh token, it could be an old token that is potentially still valid. For security
+            // reasons, we cannot accept that; at this point, we expect the refresh tokens to be explicitly redacted.
+            context.Request.RefreshToken = null;
+        }
+
+
+        return ValueTask.CompletedTask;
+    }
+
+    /// <summary>
+    /// This is invoked when extracting the auth context for a client request.
+    /// </summary>
+    public ValueTask HandleAsync(OpenIddictValidationEvents.ProcessAuthenticationContext context)
+    {
+        // For the back-office client, this only happens when an access token is sent to the API.
+        if (context.AccessToken != RedactedTokenValue)
+        {
+            return ValueTask.CompletedTask;
+        }
+
+        if (TryGetCookie(AccessTokenCookieKey, out var accessToken))
+        {
+            context.AccessToken = accessToken;
+        }
+
+        return ValueTask.CompletedTask;
+    }
+
+    public void Handle(UserLogoutSuccessNotification notification)
+    {
+        HttpContext? context = _httpContextAccessor.HttpContext;
+        if (context is null)
+        {
+            // For some reason there is no ambient HTTP context, so we can't clean up the cookies.
+            // This is OK, because the tokens in the cookies have already been revoked at user sign-out,
+            // so the cookie clean-up is mostly cosmetic.
+            return;
+        }
+
+        context.Response.Cookies.Delete(AccessTokenCookieKey);
+        context.Response.Cookies.Delete(RefreshTokenCookieKey);
+    }
+
+    private HttpContext GetHttpContext()
+        => _httpContextAccessor.GetRequiredHttpContext();
+
+    private void SetCookie(HttpContext httpContext, string key, string value)
+    {
+        var cookieValue = EncryptionHelper.Encrypt(value, _dataProtectionProvider);
+
+        var cookieOptions = new CookieOptions
+        {
+            // Prevent the client-side scripts from accessing the cookie.
+            HttpOnly = true,
+
+            // Mark the cookie as essential to the application, to enforce it despite any
+            // data collection consent options. This aligns with how ASP.NET Core Identity
+            // does when writing cookies for cookie authentication.
+            IsEssential = true,
+
+            // Cookie path must be root for optimal security.
+            Path = "/",
+
+            // For optimal security, the cooke must be secure. However, Umbraco allows for running development
+            // environments over HTTP, so we need to take that into account here.
+            // Thus, we will make the cookie secure if:
+            // - HTTPS is explicitly enabled by config (default for production environments), or
+            // - The current request is over HTTPS (meaning the environment supports it regardless of config).
+            Secure = _globalSettings.UseHttps || httpContext.Request.IsHttps,
+
+            // SameSite is configurable (see BackOfficeTokenCookieSettings for defaults):
+            SameSite = ParseSameSiteMode(_backOfficeTokenCookieSettings.SameSite),
+        };
+
+        httpContext.Response.Cookies.Delete(key, cookieOptions);
+        httpContext.Response.Cookies.Append(key, cookieValue, cookieOptions);
+    }
+
+    private bool TryGetCookie(string key, [NotNullWhen(true)] out string? value)
+    {
+        if (GetHttpContext().Request.Cookies.TryGetValue(key, out var cookieValue))
+        {
+            value = EncryptionHelper.Decrypt(cookieValue, _dataProtectionProvider);
+            return true;
+        }
+
+        value = null;
+        return false;
+    }
+
+    private static SameSiteMode ParseSameSiteMode(string sameSiteMode) =>
+        Enum.TryParse(sameSiteMode, ignoreCase: true, out SameSiteMode result)
+            ? result
+            : throw new ArgumentException($"The provided {nameof(sameSiteMode)} value could not be parsed into as SameSiteMode value.", nameof(sameSiteMode));
+}