Skip to content

Repro for ASP.NET Core bug: [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingDefault)] bypasses validation attributes on inbound requests. Properties with this attribute skip MaxLength and other validations, allowing invalid data to reach endpoint handlers.

Notifications You must be signed in to change notification settings

glenndierckx/aspnetcore-jsonignore-validation-bug

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

1 Commit
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Issue: MaxLength Validation Bypassed with JsonIgnore(WhenWritingDefault)

Summary

When using ASP.NET Core's AddValidation() in .NET 10, the [MaxLength] validation attribute is bypassed on properties that also have [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingDefault)].

Expected Behavior

Validation should work regardless of JsonIgnore attributes, since JsonIgnoreCondition.WhenWritingDefault only affects serialization output, not deserialization or validation.

Actual Behavior

Properties with [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingDefault)] skip validation entirely, allowing invalid data through.

Reproduction

public class ValidationTestRequest
{
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingDefault)]
    [MaxLength(10)]
    public string? PropertyWithJsonIgnoreWhenWritingDefault { get; set; }

    [MaxLength(10)]
    public string? PropertyWithoutJsonIgnore { get; set; }
}
var builder = WebApplication.CreateBuilder();
builder.Services.AddValidation();

var app = builder.Build();
app.MapPost("/test-validation", (ValidationTestRequest _) => Results.Ok());
  • POST with { "PropertyWithoutJsonIgnore": "ExceedsMaxLength" } returns 400 Bad Request (correct)
  • POST with { "PropertyWithJsonIgnoreWhenWritingDefault": "ExceedsMaxLength" } returns 200 OK (incorrect)

Running the Tests

dotnet test

Expected output:

  • MaxLengthValidation_ReturnsBadRequest_WhenValueExceedsLimit - Pass
  • MaxLengthValidation_ReturnsBadRequest_WhenPropertyHasJsonIgnoreWhenWritingDefault - Fail

Environment

  • .NET 10
  • Microsoft.AspNetCore.TestHost 10.0.0
  • MSTest 4.0.1

About

Repro for ASP.NET Core bug: [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingDefault)] bypasses validation attributes on inbound requests. Properties with this attribute skip MaxLength and other validations, allowing invalid data to reach endpoint handlers.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages