When you do things like call RequireAuthorization on the Blazor builder, all the endpoints start requiring auth, including endpoints like _framework/opaque-redirect or _blazor/initializers.

Reconfiguring these endpoints is "kind of painful" (see code below) because you need to "find the endpoint" and then apply the attribute.

var components = app.MapRazorComponents<App>()
    .AddInteractiveServerRenderMode()
    .RequireAuthorization();

components.Add(e => {
    if(e is RouteEndpointBuilder rb)
    {
        if(rb.RoutePattern!.RawText!.Contains("_blazor")){
            rb.Metadata.Add(new AllowAnonymousAttribute());
        }
    }
});

Ideally, we want to have some level of "first class support" for targeting these endpoints to add conventions to them without the user having to dig the details. Something like ConfigureFrameworkEndpointsMetadata that receives a callback to add metadata to those endpoints (we wouldn't expose stuff that allowed changing routes, etc. Since that's hardcoded in a bunch of places.