Skip to content

BindProperty correctly correctly does not include GET, but incorrectly includes DELETE #59010

@datner

Description

@datner

Is there an existing issue for this?

  • I have searched the existing issues

Describe the bug

I have searched far and wide, and I assume that this feature is just exceedingly rare to use for some reason,
when using [BindProperty] GET requests are not subject to the binding without opting in.
This is an arbitrary decision that is related to social consensus (and some browser implementations) rather than any spec limitations.
This is fine behavior
the DELETE request similarly does not have semantics for the message body and a body should not be sent. Allowed by the spec, just like GET, and following its precedent DELETE should also be opt-in (or at least expose an opt-out if backwards compatibility is desired).

making the property nullable

[ApiController]
class MyController : BaseController 
{
  [BindProperty]
  public Foo? foo { get; set; }
}

Does 'solve' this, but for the same reason why GET was omitted instead of the property made optional, this practically removes all the ergonomics afforded by property binding to begin with..

Expected Behavior

on an [ApiController], properties bound using [BindProperty] should have the same behavior for DELETE requests as they do for GET requests or otherwise be configurable with the same ergonomics

Steps To Reproduce

add a bound property using [BindProperty] to a controller with [ApiController], add a delete endpoint and query it

[ApiController]
class MyController : BaseController 
{
  [BindProperty]
  public Foo foo { get; set; }

  [HttpGet("{id:int}")]
  public NoContent Get(id: int) 
  {
    // Woohoo! Code executing against all odds!
    return new Foo()
  }

  [HttpDelete("{id:int}")]
  public NoContent Delete(id: int) 
  {
    // impl doesn't matter, won't reach here
  }
}

You will get a 400 response complaining about all the missing properties you forgot to include in Foo (you probably need to mark them as [Required] as well)

Exceptions (if any)

No response

.NET Version

8.0.401

Anything else?

Yes it can be solved by annotating each and every method with what it needs specifically, but I would assume that the whole point of having BindProperty and friends is to avoid that

Metadata

Metadata

Assignees

No one assigned

    Labels

    area-mvcIncludes: MVC, Actions and Controllers, Localization, CORS, most templates

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions