[release/10.0-preview7] Avoid cookie login redirects for known API endpoints

[github-actions]

Backport of #62816 to release/10.0-preview7

/cc @halter73

Avoid cookie login redirects for known API endpoints

By default, the CookieAuthenticationHandler redirects to the login page for unauthenticated requests. This does not make sense as a default behavior for API endpoints like those defined in an [ApiController] and most minimal APIs.

This PR adds IApiEndpointMetadata automatically to [ApiController]-defined endpoints and many minimal APIs where we can definitely determine that it's not returning HTML or other endpoint intended for direct browser navigation.

Description

This adds IApiEndpointMetadata as new public API. It doesn't add any attributes or extension methods, but we do add it automatically for endpoints where RDF/RDG read a JSON request body or write a JSON response body. ApiController endpoints, SignalR endpoints and endpoints with TypedResults return-types that we know to be API-oriented also get this metadata automatically.

API Proposal: #62883

Fixes: #9039

Even though IApiEndpointMetadata has not yet been approved by API Review, most users will not need to directly interact with this API to benefit from it. The vast majority of developers will not need to make any changes to their code even if the API shape changes.

Customer Impact

#9039 is one of the most thumbs-upped issues in the aspnetcore repo. Without this change, customers need to apply workarounds like the following to prevent the CookieAuthenticationHandler from redirecting to the login page for unauthenticated API requests which is a hassle when you don't already know about the workaround given that we could provide a better experience by default which we do with this PR.

services.ConfigureApplicationCookie(o =>
{
    o.Events = new CookieAuthenticationEvents()
    {
        OnRedirectToLogin = (ctx) =>
        {
            if (ctx.Request.Path.StartsWithSegments("/api") && ctx.Response.StatusCode == 200)
            {
                ctx.Response.StatusCode = 401;
            }

            return Task.CompletedTask;
        },
        OnRedirectToAccessDenied = (ctx) =>
        {
            if (ctx.Request.Path.StartsWithSegments("/api") && ctx.Response.StatusCode == 200)
            {
                ctx.Response.StatusCode = 403;
            }

            return Task.CompletedTask;
        }
    };
});

Regression?

• Yes
• No

Risk

• High
• Medium
• Low

We only add the new IApiEndpointMetadata to endpoints we are confident are not intended for direct browser navigation. Furthermore, this new metadata is only referenced by the default implementations of CookieAuthenticationEvents.OnRedirectToLogin and OnRedirectToAccessDenied which are overridable.

Verification

• Manual (required)
• Automated

Packaging changes reviewed?

• Yes
• No
• N/A

[Frulfump]

Hi @@github-actions[bot]. Please make sure you've updated the PR description to use the Shiproom Template. Also, make sure this PR is not marked as a draft and is ready-to-merge.

To learn more about how to prepare a servicing PR click here.

Lol @@

cc @halter73