Quantcast
Channel: ASPNETWebStack Issue Tracker Rss Feed
Viewing all articles
Browse latest Browse all 7215

Commented Issue: [Routing] ApiController: Selection of Actions by verb should exclude actions with ActionName attribute [377]

$
0
0
Actions with ActionName attribute should not be invoked by verb inference if RouteData does not include {action}.

If a request arrives at an ApiController without an {action} parameter being set in the RouteData, ApiControllerActionSelector uses verb inference (with FindActionsForVerb()) only. While this mostly makes sense, it means that actions decorated with a [ActionName] can still be invoked by a request coming in

Thus, with routes like:

routes.MapHttpRoute(
name: "DefaultApi",
routeTemplate: "api/{controller}/{id}",
defaults: new { id = RouteParameter.Optional }
);

And an action like this in addition to your usual Post() action:

[ActionName("Activate")]
public String Activate(User doofus) {
// (I assume that complex POCO types as a parameter automatically infers [HttpPost]).
return "Posted!";
}

Invoking "POST http://localhost:3000/api/users" may thusly end up invoking my Activate() action up there rather than my conventional Post() action, which is clearly not intended.

I propose that ApiControllerActionSelector.FindActionsForVerbWorker() excludes any actions that have an [ActionName] attribute on them. What do you guys think?
Comments: Changing this behavior would be a breaking change.

Viewing all articles
Browse latest Browse all 7215

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>