Skip to content

RequestDelegateFactory should return "415 Unsupported Media Type" response when parameter binding and the request isn't JSON #35856

@DamianEdwards

Description

@DamianEdwards

The implicit request body reading done by RequestDelegateFactory to populate FromBody parameters of the route handler blindly assumes the request body format is JSON, even when the request is sent with at Content-Type header that indicates the format is something other than JSON. This leads to a JSON deserialization exception being thrown if a request is sent with, e.g., XML, but the route handler relies on the default parameter binding logic.

Rather than always trying to deserialize the request body as JSON, the Content-Type header should first be checked and if it's not JSON, a "415 Unsupported Media Type" response should be returned. Note this only applies to the implicit/default request body deserialization logic, not in cases where the parameter is populated by a BindAsync method on the target type.

Metadata

Metadata

Assignees

Labels

Priority:1Work that is critical for the release, but we could probably ship withoutarea-minimalIncludes minimal APIs, endpoint filters, parameter binding, request delegate generator etcbugThis issue describes a behavior which is not expected - a bug.feature-minimal-actionsController-like actions for endpoint routingold-area-web-frameworks-do-not-use*DEPRECATED* This label is deprecated in favor of the area-mvc and area-minimal labels

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions