Why does setting a default authentication scheme unnecessarily add Authentication middleware to endpoints that don't require authentication?

[a510]

In the code below the CookieAuthenticationHandler fires and tries to authenticate the request although I didn't call app.UseAuthentication() or app.UseAuthorization() or RequireAuthorization(). Why is that and how to avoid this behavior for endpoints that don't require authentication?

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddAuthentication("Cookies").AddCookie();

var app = builder.Build();
app.MapGet("/hello", () => "hello world");       // .AllowAnonymous(); doesn't work as well

app.Run();

[gfoidl]

From Enabling authentication in minimal apps

By default, the WebApplication automatically registers the authentication and authorization middlewares if certain authentication and authorization services are enabled.