while with server/externalFetch there is no direct way to pass cookie headers from the original request to the external one

Right now I am working around this issue by having an internal [...api].js, then call fetch for that endpoint (which automatically passes on cookies) and from there hit the actual external endpoint. It works, there is no risk of leaking anything, but imo shouldn't be necessary.

Sure you can abuse session but I don't like that since there is the risk of exposing credentials to client side code.

I don't know how much workaround is it, but for now I'm using this approach: