Blazor server side Cookie Authentication - direct link work even user is not authenticated

Question

I'm follow this tutorial for simple cookie auth in Blazor server side.

for the most part i got it working but user can still access the page mark with

@attribute [Authorize(Roles = "User, Admin")]

via direct link.

the navi link that I have on the menu marked with will not show unless user login. so i believe it work.

the first comment in the tutorial said change:

<routeview routedata="@routeData" defaultlayout="@typeof(MainLayout)"/>

to

<authorizerouteview routedata="@routeData" defaultlayout="@typeof(MainLayout)"/>

and the whole site is blank