ASP.NET Core Pitfalls - Action Constraint Order

Introduction

When we have more than one action method in MVP or Web API that can match a given request, the request may fail or land on an unwanted method. By default, a number of items is used to figure out which method to call:

  • The HTTP verb
  • The action method name
  • The route template
  • The action method parameters
  • The request content type

An action constaint may be needed to select the right one; an action constraint is an implementation of IActionConstraint, and is normally added through an attribute or a convention. Some examples of built-in action constrains include:

If you want to build your own, you should inherit from ActionMethodSelectorAttribute and implement IsValidForRequest.

Problem

Sometimes, however, just applying an action constraint is not enough, usually because the request matches more than one constraint. One example is with subsets of a given content type, the [Consumes] will also validate against those.

What we then need is to define the order by which we want the constraints checked, where the most "unusual" should go first. This is achieved through the Order property of IActionConstraint or the Order property of HttpMethodAttribute; the smaller order is executed first.

An example using [HttpPatch]:

[HttpPatch]
[Consumes("application/json")]
public IActionResult PatchJson([FromBody] Payload payload)
{            
    //...
}

[HttpPatch(Order = -1000)]
[Consumes("application/merge-patch+json")]
public IActionResult PatchMergePatchJson([FromBody] Payload payload)
{
    //...
}

When a request is made using "application/json" content-type, the first method matches; when using "application/merge-patch+json", the second does. In this case, the problem is that "application/merge-patch+json" is treated as a subset of "application/json".

Conclusion

Because ASP.NET Core is so flexible, it's usually easy to fix this kind of problems, once we know what they are. Stay tuned for more!

Location: Coimbra, Portugal

Comments

Post a Comment

Popular posts from this blog

OpenTelemetry with ASP.NET Core

Image
Introduction I wrote a post not too long ago about the building blocks of telemetry , or distributed tracing , with ASP.NET Core. Now I'm going to talk about how we can see it working using an open source bundle, otel-lgtm . Mind you, this may not be 100% suitable for production, but for development purposes, it should be fine, all concepts apply, of course. I won't cover everything about OpenTelemetry here, but should hopefully give you some insights as to what's there and how you can make good use of it. First, lets see what some of the concepts are. If you're interested in learning more about metrics, I suggest having a look at my post on this topic . OpenTelemetry OpenTelemetry  (OTel) provides a single, open-source standard, and a set of technologies to capture and export metrics, traces, and logs from your cloud-native applications and infrastructure. OTel is both a standard and a reference implementation that builds on other standards, such as W3C Distributed Tr...
Read more

ASP.NET Core Middleware

Image
Introduction This post is another of those "back to basics", still, there was one thing or two that I feel were not properly discussed elsewhere, hence this post. The ASP.NET Core Pipeline and Middleware You may know that ASP.NET Core defines a pipeline. This is where the incoming requests are processed and the response submitted. Each component in the pipeline - a middleware - can do things with the message (the request), such as check if it is authenticated and have rights to access the requested resource, turn the request into an MVC-style controller and action invocation, log it, and what not. You can read more about it here . The ASP.NET Core pipeline, from Microsoft The order by which the middleware is added to the pipeline matters. For example, the authorisation middleware must come after the authentication one, static files must come before routing, and exception handling must come before everything. The middleware order, from Microsoft A middleware is just a piece of...
Read more

.NET Cancellation Tokens

Introduction Cancellation tokens in .NET were introduced as part of the  .NET 4 Cancellation Framework . Essentially, it is a standard, cooperative, way to request for the cancellation of the execution of an operation. By cooperative it means that the code that uses it must abide to some rules, as opposed to the cancellation just stopping (killing) the execution. One example of cancellation is, on a web app, when the client closes the connection while the server is performing some long operation. In cases such as this, we may want to abort the operation, as we are not sending the results anywhere (or not, as we shall see). Because of this, ASP.NET Core allows us to add a parameter of type  CancellationToken  to our asynchronous actions, it is automatically associated with the client and is therefore signalled when the client connection is closed. A  CancellationToken  is, essentially, behind the scenes, a ManualResetEvent . Throughout this article I will either ...
Read more