The issue is that model binding supports a direct mode where parameters are taken from the value providers(lets say route data) and then directly bound to the action parameters.
This mode doesn't support validation as until now, it only works for primitive types and they don't require any validation.
By adding this custom value provider we now support model binding non-primitive types using this code path and that is why validation is not being performed.
Comments: Repro ``` using Microsoft.Owin.Hosting; using Owin; using System; using System.ComponentModel.DataAnnotations; using System.Net; using System.Net.Http; using System.Web.Http; namespace SampleOwinApp { class Program { static void Main(string[] args) { string baseAddress = string.Format("http://{0}:9095", Environment.MachineName); using (WebApp.Start<Program>(url: baseAddress)) { HttpClient client = new HttpClient(); HttpResponseMessage response = client.GetAsync(baseAddress + "/values?color=red").Result; Console.WriteLine(response.ToString()); Console.WriteLine(response.Content.ReadAsStringAsync().Result); //Console.WriteLine("Listenting at {0}...", baseAddress); //Console.ReadLine(); } } public void Configuration(IAppBuilder appBuilder) { var config = new HttpConfiguration(); config.MapHttpAttributeRoutes(); config.Routes.MapHttpRoute("default", "{controller}", new { test = new TestClass { Id = 42, Name = "Mike" } }); config.EnsureInitialized(); appBuilder.UseWebApi(config); } } public class Something { [Required] [MinLength(3)] public string Color { get; set; } public TestClass Test { get; set; } } public class TestClass { public int Id { get; set; } [Required] [MinLength(10)] public string Name { get; set; } } public class ValuesController : ApiController { public Something Get([FromUri]Something something) { if (!ModelState.IsValid) { throw new HttpResponseException(Request.CreateErrorResponse(HttpStatusCode.BadRequest, this.ModelState)); } return something; } } } ```
This mode doesn't support validation as until now, it only works for primitive types and they don't require any validation.
By adding this custom value provider we now support model binding non-primitive types using this code path and that is why validation is not being performed.
Comments: Repro ``` using Microsoft.Owin.Hosting; using Owin; using System; using System.ComponentModel.DataAnnotations; using System.Net; using System.Net.Http; using System.Web.Http; namespace SampleOwinApp { class Program { static void Main(string[] args) { string baseAddress = string.Format("http://{0}:9095", Environment.MachineName); using (WebApp.Start<Program>(url: baseAddress)) { HttpClient client = new HttpClient(); HttpResponseMessage response = client.GetAsync(baseAddress + "/values?color=red").Result; Console.WriteLine(response.ToString()); Console.WriteLine(response.Content.ReadAsStringAsync().Result); //Console.WriteLine("Listenting at {0}...", baseAddress); //Console.ReadLine(); } } public void Configuration(IAppBuilder appBuilder) { var config = new HttpConfiguration(); config.MapHttpAttributeRoutes(); config.Routes.MapHttpRoute("default", "{controller}", new { test = new TestClass { Id = 42, Name = "Mike" } }); config.EnsureInitialized(); appBuilder.UseWebApi(config); } } public class Something { [Required] [MinLength(3)] public string Color { get; set; } public TestClass Test { get; set; } } public class TestClass { public int Id { get; set; } [Required] [MinLength(10)] public string Name { get; set; } } public class ValuesController : ApiController { public Something Get([FromUri]Something something) { if (!ModelState.IsValid) { throw new HttpResponseException(Request.CreateErrorResponse(HttpStatusCode.BadRequest, this.ModelState)); } return something; } } } ```