Same policy, same JSON, one word apart.

One answers 401. One still redirects.

ANONYMOUS REQUEST GET /min/typed-results · GET /min/results-ok

.MapGet(path, () => TypedResults.Ok(thing))
.RequireAuthorization("staff")

↓ COOKIE HANDLER CHALLENGES

401Unauthorized

Location: /Account/Login?ReturnUrl=%2Fmin%2Ftyped-results

.MapGet(path, () => Results.Ok(thing))
.RequireAuthorization("staff")

↓ COOKIE HANDLER CHALLENGES

302Found

Location: /Account/Login?ReturnUrl=%2Fmin%2Fresults-ok

the old exception survives: X-Requested-With: XMLHttpRequest still turns both sides into 401

what decides it endpoint metadata, not the route — ASP.NET Core 10 adds IDisableCookieRedirectMetadata for [ApiController], TypedResults, SignalR and minimal APIs that read or write JSON, the list the breaking-change notice gives

ASP.NET Core 10.0.5 · on 9.0.14 both sides answer 302 · every value asserted by the demo's tests

gdhami.net