RequestDelegateFactory should return "415 Unsupported Media Type" response when parameter binding and the request isn't JSON #35856
Labels
area-minimal
Includes minimal APIs, endpoint filters, parameter binding, request delegate generator etc
bug
This issue describes a behavior which is not expected - a bug.
feature-minimal-actions
Controller-like actions for endpoint routing
old-area-web-frameworks-do-not-use
*DEPRECATED* This label is deprecated in favor of the area-mvc and area-minimal labels
Priority:1
Work that is critical for the release, but we could probably ship without
Milestone
The implicit request body reading done by
RequestDelegateFactory
to populateFromBody
parameters of the route handler blindly assumes the request body format is JSON, even when the request is sent with atContent-Type
header that indicates the format is something other than JSON. This leads to a JSON deserialization exception being thrown if a request is sent with, e.g., XML, but the route handler relies on the default parameter binding logic.Rather than always trying to deserialize the request body as JSON, the
Content-Type
header should first be checked and if it's not JSON, a "415 Unsupported Media Type" response should be returned. Note this only applies to the implicit/default request body deserialization logic, not in cases where the parameter is populated by aBindAsync
method on the target type.The text was updated successfully, but these errors were encountered: