-
Notifications
You must be signed in to change notification settings - Fork 10.4k
Description
The implicit request body reading done by RequestDelegateFactory
to populate FromBody
parameters of the route handler blindly assumes the request body format is JSON, even when the request is sent with at Content-Type
header that indicates the format is something other than JSON. This leads to a JSON deserialization exception being thrown if a request is sent with, e.g., XML, but the route handler relies on the default parameter binding logic.
Rather than always trying to deserialize the request body as JSON, the Content-Type
header should first be checked and if it's not JSON, a "415 Unsupported Media Type" response should be returned. Note this only applies to the implicit/default request body deserialization logic, not in cases where the parameter is populated by a BindAsync
method on the target type.