If you're considering PuppeteerSharp for PDF generation, here's the version of the story that doesn't show up in the "getting started" docs.
Attackers don't need any special authentication to reach a target endpoint — they just need to know where it is.