How do I get WebAPI to validate my JSON with JsonProperty(Required = Required.Always)?

Question

public class MyModel
{
    [JsonProperty(PropertyName = "foo", Required = Required.Always)]
    public String Bar;
}

public class MyController : ApiController
{
    public String PostVersion1([FromBody] MyModel myModel)
    {
        if (ModelState.IsValid)
        {
            if (myModel.Bar == null)
                return "What?!";
            else
                return "Input is valid.";
        }
        else
        {
            return "Input is invalid.";
        }
    }
}

Results:

Input              |Output
-------------------|------
{ "bad" : "test" } | What?!
{ "Bar" : "test" } | What?!
{ "foo" : "test" } | Input is valid.

JsonPropertyAttribute is clearly supported because I am able to set the PropertyName and have it take effect. However, I would expect the ModelState.IsValid to be false for the first two example inputs because the Required JsonProprty parameter was set to Always.

If I just run it through JsonConvert:

JsonConvert.DeserializeObject<MyModel>(@"{'bad':'test'}");

an exception is thrown during deserialization as expected:

Result Message: Newtonsoft.Json.JsonSerializationException : Required property 'foo' not found in JSON. Path '', line 1, position 14.

score 5 · Answer 1 · answered Aug 02 '14 at 06:29

5

The default JsonMediaTypeFormatter does not rely on on he JsonProperty to decide whether model fields are required or not. It does rely however on the RequiredAttribute

If you want to do this then implement a new IRequiredMemberSelector and set it to MediaTypeFormatter.RequiredMemberSelector.

In your implementation of IRequiredMemberSelector you will be passed a MemberInfo. You can use that to evaluate if model members have the JsonProperty attribute and if the required flag is set, and finally return true or false. This will be propagated to the ModelState.IsValid property (it will not use the JSON.NET error message though, but the DataAnnotations/WebApi one.

If you do this, then I suggest you also keep the default behavior.

answered Aug 02 '14 at 06:29

Marcel N.

13,726
5
47
72

I can't use RequiredAttribute because it appears that that takes effect before the name routing of the JSON deserializer. In the above examples, { "Bar" : "test" } will validate even though once it deserializes Bar will be null. – Micah Zoltu Aug 02 '14 at 06:36
It would seem that the RequiredMemberSelector is run first, and then after it is validated the type is deserialized. Is it possible to deserialize and then validate or do both in one step without having to litter my controller actions with JsonConvert.Deserialize calls? It seems that the more correct course of action here (especially since I want to return an error on deserialization failure) would be to deserialize first and then call the action if deserialization was a success. If I am understanding correctly, validation occurs first then deserialization. – Micah Zoltu Aug 02 '14 at 06:39
@MicahCaldwell: Let me check. – Marcel N. Aug 02 '14 at 06:46
@MicahCaldwell: Actually, if you deserialize first then validate you lose the JSON and therefore any meaningful error. You won't be able to output an error like `JsonConvert` does. So, it rather should be the other way around. Have a look also at `JsonContractResolver.ConfigureProperty`. It always sets `property.Required = Required.AllowNull`, so that needs to be changed as well. This happens prior to deserialization. – Marcel N. Aug 02 '14 at 06:59
1

@MicahCaldwell: Not sure anymore if it will work at all using this path. If you take a look at `BaseJsonMediaTypeFormatter.ReadFromStream` it becomes obvious that any JSON.NET exception is silenced. – Marcel N. Aug 02 '14 at 07:17

Micah Zoltu · Accepted Answer · 2015-10-05T03:05:44.450

In order to solve this I ended up creating my own custom JSON.NET MediaTypeFormatter. My formatter allows the JSON.NET deserialization exceptions bubble out which results in the exception information being returned to the caller.

Here is the MediaTypeFormatter I built:

public class JsonMediaFormatter : MediaTypeFormatter
{
    private readonly JsonSerializer _jsonSerializer = new JsonSerializer();

    public JsonMediaFormatter()
    {
        SupportedMediaTypes.Add(new MediaTypeHeaderValue("application/json"));
    }

    public override Boolean CanReadType(Type type)
    {
        if (type == null)
            return false;

        return true;
    }

    public override Boolean CanWriteType(Type type)
    {
        if (type == null)
            return false;

        return true;
    }

    public override Task<Object> ReadFromStreamAsync(Type type, Stream readStream, HttpContent content, IFormatterLogger formatterLogger)
    {
        return Task.FromResult(Deserialize(readStream, type));
    }

    public override Task WriteToStreamAsync(Type type, Object value, Stream writeStream, HttpContent content, TransportContext transportContext, CancellationToken cancellationToken)
    {
        Serialize(writeStream, value);
        return Task.FromResult(0);
    }

    private Object Deserialize(Stream readStream, Type type)
    {
        var streamReader = new StreamReader(readStream);
        return _jsonSerializer.Deserialize(streamReader, type);
    }

    private void Serialize(Stream writeStream, Object value)
    {
        var streamWriter = new StreamWriter(writeStream);
        _jsonSerializer.Serialize(streamWriter, value);
        streamWriter.Flush();
    }
}

In order to use this formatter over the built-in one, I added this line to my WebApiConfig:

config.Formatters.Insert(0, new Formatters.JsonMediaFormatter());

By inserting it at index 0, it takes precedence over the built-in formatter. If you care, you could remove the built-in JSON formatter.

In this scenario, the ModelState is always valid in the action because an exception is thrown back to the user before the action is ever fired if deserialization fails. More work would need to be done in order to still execute the action with a null FromBody parameter.

In release builds, it appears that the exception is swallowed and a generic exception is sent back to the user. Research is necessary to make it send back useful errors. — Micah Zoltu, Aug 03 '14 at 08:41
Solved the error being sent back with an exception filter that builds a special response (400) when it sees a JsonSerializationException. — Micah Zoltu, Aug 03 '14 at 20:16
Why are you using Task.Factory.StartNew()?? Just use Task.FromResult(...). It's a bad practice to use Task.Factory.StarNew() for CPU bound operations. — Stefan Ossendorf, Dec 10 '14 at 10:23
`Task.FromResult(Serialize(...))` does not compile because it returns void. You should call `Serialize()` first, then do `Task.FromResult(0)`. — Dave Van den Eynde, Oct 01 '15 at 07:23
I decided to catch the serialization exception inside the formatter to throw a 400 myself. Anyway, this needs more upvotes. — Dave Van den Eynde, Oct 01 '15 at 08:14
I tried this. The formatter is instantiated, but the `Deserialize` method in the formatter is never called. — Florian Winter, May 20 '20 at 11:25
Turned out I already had code messing with the Formatters in GlobalConfiguration elsewhere in my project. So if your custom formatter does not get called, search for "Formatters" in your code. — Florian Winter, May 20 '20 at 11:37

score 3 · Answer 3 · answered Jan 09 '19 at 07:15

I know this is an old question but I solved it like this:

var formatter = new JsonMediaTypeFormatter {
    SerializerSettings = {
        ContractResolver = new DefaultContractResolver(true)
    }
};
configuration.Formatters.Insert(0, formatter);

The parsing errors will then be included in ModelState

Florian Winter · Answer 4 · 2020-03-03T07:51:04.943

If you only want to support JSON, then you can do this:

public String PostVersion1([FromBody] JObject json)
{
  if(json == null) {
    // Invalid JSON or wrong Content-Type
    throw new HttpResponseException(HttpStatusCode.BadRequest);
  }

  MyModel model;
  try
  {
    model = json.ToObject<MyModel>();
  }
  catch(JsonSerializationException e)
  {
    // Serialization failed
    throw new HttpResponseException(HttpStatusCode.BadRequest);
  }
}

But you don't want to do this in every request handler. This is one of multiple flaws of the [FromBody] attribute. See here for more details: https://stackoverflow.com/a/52877955/2279059

How do I get WebAPI to validate my JSON with JsonProperty(Required = Required.Always)?

4 Answers4