I have a Blazor Web App that uses cookie authentication (not the built-in Identity). I’m trying to understand why when I authenticate the user directly in the application, the authentication cookie is included in the response header and shows up in the browser cookies tab, but if I put the authentication logic, same code, behind an endpoint, then the cookie is not included anymore. To add more confusion, if I consume the endpoint from an external tool like Insomnia, http file or Postman, I can see the cookie in the response header, so it has to do with the client type.
This is Blazor Web App with global interactive auto, but I’m sure it doesn’t matter here.
Login component runs static SSR mode:

Here the login logic I’m executing directly in the login component and from an end point(minimal api)

  var claims = new List<Claim>
  {
      new(ClaimTypes.NameIdentifier, user.Email),
      new(ClaimTypes.Name, user.UserName),
      new(ClaimTypes.Role, "TestRole"),
};

var claimsIdentity = new ClaimsIdentity(
    claims,
    CookieAuthenticationDefaults.AuthenticationScheme);

var claimsPrincipal = new ClaimsPrincipal(claimsIdentity);

await HttpContext.SignInAsync(
     CookieAuthenticationDefaults.AuthenticationScheme,
     claimsPrincipal);

Cookie authentication config in Program.cs (Blazor server project)

builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(options =>
    {
        options.Cookie.Name = CookieAuthenticationDefaults.AuthenticationScheme;
        options.ExpireTimeSpan = TimeSpan.FromMinutes(20);
        options.SlidingExpiration = true;        
        options.AccessDeniedPath = "/Account/AccessDenied";
        options.LogoutPath = "/Account/Logout";
        options.Cookie.SameSite = SameSiteMode.Strict;
        options.Cookie.HttpOnly = true;
        options.Cookie.SecurePolicy = CookieSecurePolicy.Always;        
        options.Cookie.IsEssential = true;
    });