Avoid cookie login redirects for known API endpoints

[halter73]

This adds IApiEndpointMetadata as new public API. It doesn't add any attributes or extension methods, but we do add it automatically for endpoints where RDF/RDG read a JSON request body or write a JSON response body. ApiController endpoints, SignalR endpoints and endpoints with TypedResults return-types that we know to be API-oriented also get this metadata automatically.

API Proposal: #62883

Fixes #9039

[Copilot]

Pull Request Overview

This PR introduces IApiEndpointMetadata as a new public interface to identify API endpoints that should avoid cookie authentication redirects in favor of status codes. The interface is automatically added to endpoints that expect JSON request bodies or return JSON responses, signaling they are programmatic APIs rather than browser-navigated endpoints.

Key changes:

• Adds IApiEndpointMetadata interface and internal implementation
• Modifies cookie authentication to check for this metadata and return 401/403 status codes instead of redirects
• Updates HTTP Results types and request delegate generation to automatically add the metadata

Reviewed Changes

Copilot reviewed 107 out of 108 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/Http/Http.Abstractions/src/Metadata/IApiEndpointMetadata.cs	Defines the new public interface for API endpoint identification
src/Security/Authentication/Cookies/src/CookieAuthenticationEvents.cs	Updates authentication logic to check for API endpoints and return status codes
src/Mvc/Mvc.Core/src/ApiControllerAttribute.cs	Makes ApiControllerAttribute implement IApiEndpointMetadata
Multiple HTTP Results files	Adds IApiEndpointMetadata to various result types' PopulateMetadata methods
Request delegate generator files	Updates code generation to automatically add API metadata

Comments suppressed due to low confidence (1)

src/Security/Authentication/test/CookieTests.cs:130

• The comment references 'INonBrowserEndpointMetadata' but the code adds 'ApiEndpointMetadata.Instance'. The comment should be updated to reflect the actual metadata being added.

        var transaction = await SendAsync(server, "http://example.com/protected/CustomRedirect");

[BrennanConroy]

Suggested change

	// Add INonBrowserEndpointMetadata to indicate this is a non-browser endpoint (SignalR)
	// Add IApiEndpointMetadata to indicate this is a non-browser endpoint (SignalR)

[BrennanConroy]

Wonder if there are any blazor endpoints that should also be marked?

[halter73]

One of the big reasons that I went with this approach rather than trying to detect fetch requests is because blazor will gracefully handle redirects during enhanced navigation. If we started returning 401s instead of redirecting, we'd break the default Blazor template with individual auth. We could special case blazor fetch requests to avoid this, but I thought it was indicative of the risk of defaulting to 401 for all fetch requests.

For the circuit endpoints, we already get the better behavior because if this change to the SignalR endpoints. It's possible that I'm missing some Blazor related API endpoints that don't get picked up automatically by the RDF/RDG changes (MapIdentityApi is an example of endpoints that get the metadata for free this way), but I'm not sure what they'd be off the top of my head. @javiercn @MackinnonBuck Do you have any suggestions?

[BrennanConroy]

aspnetcore/src/Components/Server/src/Builder/ComponentEndpointRouteBuilderExtensions.cs

Lines 78 to 86 in bf1f642

	var disconnectEndpoint = endpoints.Map(
	(path.EndsWith('/') ? path : path + "/") + "disconnect/",
	endpoints.CreateApplicationBuilder().UseMiddleware<CircuitDisconnectMiddleware>().Build())
	.WithDisplayName("Blazor disconnect");
	var jsInitializersEndpoint = endpoints.Map(
	(path.EndsWith('/') ? path : path + "/") + "initializers/",
	endpoints.CreateApplicationBuilder().UseMiddleware<CircuitJavaScriptInitializationMiddleware>().Build())
	.WithDisplayName("Blazor initializers");

These are what I was thinking of @dotnet/aspnet-blazor-eng thoughts?

[halter73]

/backport to release/10.0-preview7

[github-actions]

Started backporting to release/10.0-preview7: https://github.com/dotnet/aspnetcore/actions/runs/16484743945