CoreWebView2NavigationStartingEventArgs.Cancel not working correctly

Description
We cancel a navigation in the NavigationStarting event, however we still see the navigation in our server logs, and it is consuming a one-time use ticket in the process. We intend to cancel the inline navigation and open it, including the one-time use ticket, in an external browser.

Version
SDK: v1.0.955-prerelease
Runtime: Stable 93.0.961.38
Framework: WinForms
OS: Windows 10 Version 21H1

Repro Steps
We have created a minimal example running on a local IIS server and are using the following WinForms application to access it:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using System.Windows.Forms;

using Microsoft.Web.WebView2.Core;
using Microsoft.Web.WebView2.WinForms;

namespace WebView2BugNavigationStarting
{
    static class Program
    {
        /// <summary>
        /// The main entry point for the application.
        /// </summary>
        [STAThread]
        static void Main()
        {
            Application.EnableVisualStyles();
            Application.SetCompatibleTextRenderingDefault(false);
            Application.Run(CreateNewForm());
        }

        private static Form CreateNewForm()
        {
            var form = new Form
            {
                Size = new System.Drawing.Size(800, 600)
            };

            var webView2 = new WebView2
            {
                Dock = DockStyle.Fill,
                Source = new Uri(@"http://pc-fvhe.ourcompanynetwork.lan:91/")
            };
            webView2.NavigationStarting += (sender, e) =>
            {
                if (e.Uri == @"http://pc-fvhe.ourcompanynetwork.lan:91/files/text.txt")
                {
                    e.Cancel = true;
                }
            };

            form.Controls.Add(webView2);

            return form;
        }
    }
}

Basically the site running at http://pc-fvhe.ourcompanynetwork.lan:91/ has two file links, one to picture.png and one to the text.txt mentioned in the code. We explicitly cancel navigation to text.txt as we do not want to navigate to that url.

What we observe in the IIS logs after first clicking the picture.png link and then clicking the text.txt link is the following:

2021-09-09 08:28:09 192.168.51.117 GET / - 91 - 192.168.51.117 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/93.0.4577.63+Safari/537.36+Edg/93.0.961.38 - 200 0 0 17
2021-09-09 08:28:09 192.168.51.117 GET /favicon.ico - 91 - 192.168.51.117 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/93.0.4577.63+Safari/537.36+Edg/93.0.961.38 http://pc-fvhe.ourcompanynetwork.lan:91/ 404 0 2 1
2021-09-09 08:28:13 192.168.51.117 GET /files/picture.png - 91 - 192.168.51.117 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/93.0.4577.63+Safari/537.36+Edg/93.0.961.38 http://pc-fvhe.ourcompanynetwork.lan:91/ 200 0 0 2
2021-09-09 08:28:17 192.168.51.117 GET /files/text.txt - 91 - 192.168.51.117 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/93.0.4577.63+Safari/537.36+Edg/93.0.961.38 http://pc-fvhe.ourcompanynetwork.lan:91/ 200 0 0 1

We do not expect the text.txt file to be accessed here since we canceled the navigation.

Note: The issue does not seem to reproduce when we navigate to simply http://localhost, keep that in mind if you want to test it, you need an externally accessible url.

After reading the documentation at the CoreWebView2NavigationStartingEventArgs.Cancel Property we see that "For performance reasons, GET HTTP requests may happen, while the host is responding.", we suspect this may be part of the issue.
However we want to make very clear that we think that correctness should precede performance, if we have a NavigationStarting event with the option to cancel the navigation, then we expect the navigation to not take place. Hence why we deem this to be a bug, in case this behavior cannot be changed we still expect an option to disable this in our eyes unwanted behavior.

AB#35916005

Start with the minimal WinForms example and its NavigationStarting handler, using an externally accessible URL rather than localhost. Reproduce the text.txt navigation and compare the IIS logs with the expected cancellation behavior; done means determining whether the request can be prevented or documenting the required behavior change.