Actions with ActionName attribute should not be invoked by verb inference if RouteData does not include {action}.
If a request arrives at an ApiController without an {action} parameter being set in the RouteData, ApiControllerActionSelector uses verb inference (with FindActionsForVerb()) only. While this mostly makes sense, it means that actions decorated with a [ActionName] can still be invoked by a request coming in
Thus, with routes like:
routes.MapHttpRoute(
name: "DefaultApi",
routeTemplate: "api/{controller}/{id}",
defaults: new { id = RouteParameter.Optional }
);
And an action like this in addition to your usual Post() action:
[ActionName("Activate")]
public String Activate(User doofus) {
// (I assume that complex POCO types as a parameter automatically infers [HttpPost]).
return "Posted!";
}
Invoking "POST http://localhost:3000/api/users" may thusly end up invoking my Activate() action up there rather than my conventional Post() action, which is clearly not intended.
I propose that ApiControllerActionSelector.FindActionsForVerbWorker() excludes any actions that have an [ActionName] attribute on them. What do you guys think?
Comments: Changing this behavior would be a breaking change.
If a request arrives at an ApiController without an {action} parameter being set in the RouteData, ApiControllerActionSelector uses verb inference (with FindActionsForVerb()) only. While this mostly makes sense, it means that actions decorated with a [ActionName] can still be invoked by a request coming in
Thus, with routes like:
routes.MapHttpRoute(
name: "DefaultApi",
routeTemplate: "api/{controller}/{id}",
defaults: new { id = RouteParameter.Optional }
);
And an action like this in addition to your usual Post() action:
[ActionName("Activate")]
public String Activate(User doofus) {
// (I assume that complex POCO types as a parameter automatically infers [HttpPost]).
return "Posted!";
}
Invoking "POST http://localhost:3000/api/users" may thusly end up invoking my Activate() action up there rather than my conventional Post() action, which is clearly not intended.
I propose that ApiControllerActionSelector.FindActionsForVerbWorker() excludes any actions that have an [ActionName] attribute on them. What do you guys think?
Comments: Changing this behavior would be a breaking change.