Emit antiforgery only when streaming

Author: javiercn

src/Components/Endpoints/src/RazorComponentEndpointInvoker.cs

@@ -76,14 +76,6 @@ private async Task RenderComponentCore(HttpContext context)
             return;
         }
 
-        context.Response.OnStarting(() =>
-        {
-            // Generate the antiforgery tokens before we start streaming the response, as it needs
-            // to set the cookie header.
-            antiforgery!.GetAndStoreTokens(context);
-            return Task.CompletedTask;
-        });
-
         if (httpActivityContext != default)
         {
             _activityLinkStore.SetActivityContext(ComponentsActivityLinkStore.Http, httpActivityContext, null);
@@ -154,6 +146,8 @@ await _renderer.InitializeStandardComponentServicesAsync(
 
         if (!quiesceTask.IsCompletedSuccessfully)
         {
+            // We need to ensure that the antiforgery tokens are generated and stored in the response
+            antiforgery!.GetAndStoreTokens(context);
             await _renderer.SendStreamingUpdatesAsync(context, quiesceTask, bufferWriter);
         }
         else