Add documentation for .NET 10 API endpoint authentication behavior changes

[Copilot]

Fixes #35894.

This PR adds comprehensive documentation for a significant authentication behavior change introduced in ASP.NET Core 10, where known API endpoints no longer redirect to login pages when using cookie authentication.

Changes Made

New Documentation:

• Main topic: aspnetcore/security/authentication/api-endpoint-auth.md - A comprehensive guide explaining the new behavior, why it was needed, and how it works
• Include file: aspnetcore/includes/api-endpoint-auth.md - A reusable important notice that can be referenced across multiple topics

Updated Topics:
The include notice has been added to four key documentation files where this behavior change is most relevant:

• aspnetcore/security/authentication/cookie.md - Cookie authentication documentation
• aspnetcore/web-api/index.md - Web API overview
• aspnetcore/fundamentals/minimal-apis/responses.md - Minimal API responses
• aspnetcore/signalr/authn-and-authz.md - SignalR authentication

Table of Contents:

• Added the new API endpoint authentication behavior document to the TOC under Security > Authentication section

What This Addresses

In previous versions of ASP.NET Core, API endpoints using cookie authentication would incorrectly redirect unauthenticated requests to login pages (returning 302 status codes), which is inappropriate for programmatic API access. Starting with ASP.NET Core 10, the framework automatically detects API endpoints and returns proper 401/403 status codes instead, while continuing to redirect web pages to login pages as expected.

The new documentation explains:

• The problem this change solves
• Which endpoints are automatically detected as API endpoints
• Before/after HTTP response examples
• Migration considerations for existing applications
• How to test the new behavior

Fixes #35894.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[wadepickett]

@copilot

Update the PR based on this additional instruction:

The placement of the new api-endpoint-auth.md include does not follow the updated guidance.
Please update the PR as follows:

• Do not place the include at the very top or very bottom of the file.
• Insert the include after the introductory/contextual paragraphs and before the first major heading or section (such as a list of return types or code/configuration sections).
• If the file has a section specifically about authentication, responses, or API behavior, place the include at the start of that section.
• Ensure the include is in the natural reading flow, after the context/intent is established but before technical details.
• If unsure, place the include after any “not latest version” banners and after the first paragraph introducing the main topic, but before technical/code content.

[wadepickett]

@copilot

Update the PR based on this additional instruction:

The placement of the new api-endpoint-auth.md include does not follow the updated guidance.
Please update the PR as follows:

Do not place the include at the very top or very bottom of the file.
Insert the include after the introductory/contextual paragraphs and before the first major heading or section (such as a list of return types or code/configuration sections).
If the file has a section specifically about authentication, responses, or API behavior, place the include at the start of that section.
Ensure the include is in the natural reading flow, after the context/intent is established but before technical details.
If unsure, place the include after any “not latest version” banners and after the first paragraph introducing the main topic, but before technical/code content.

[Copilot]

@copilot

Update the PR based on this additional instruction:
...

Updated the placement of the API endpoint authentication include based on your guidance. Changes made:

1. aspnetcore/fundamentals/minimal-apis/responses.md: Added introductory context and moved the include after establishing the topic but before technical content
2. aspnetcore/signalr/authn-and-authz.md: Moved the include to within the authentication section after context is established

The other two files (cookie.md and web-api/index.md) already had good placement following the guidelines.

Fixed in commit f99f5dd.

@copilot

Update the PR based on this additional instruction:
...

Updated the placement of the API endpoint authentication include following your updated guidance. The include is now positioned after introductory/contextual paragraphs and before major sections in all files.

Fixed in commit f99f5dd.

[wadepickett]

@copilot, the new document needs an appropriate entry in the TOC

[Copilot]

@copilot, the new document needs an appropriate entry in the TOC

Added the API endpoint authentication behavior document to the TOC under Security > Authentication section, positioned after the cookie authentication entry since it's specifically about cookie authentication behavior for APIs. Commit 636a0e5.