How to disable server side validation mvc web api controller

Question

How to disable server side validation mvc web api controller. please tell me a simple way to use my custom validation.

Answer 1

try to use

[ValidateInput(false)]

with action method

Answer 2

The answer from @peco only clears the validation, but the validation runs anyway.

To disable the validation for a controller you can clear the ModelValidatorProvider for the specific controller with a custom IControllerConfiguration attribute.

public class DisableModelValidatorAttribute : Attribute, IControllerConfiguration
{
    public void Initialize(HttpControllerSettings settings,
        HttpControllerDescriptor descriptor)
    {
        settings.Services.Clear(typeof(ModelValidatorProvider));
    } 
}

And just apply the Attribute to the controller:

[DisableModelValidator]
public class SomeController : ApiController
{
    public IHttpActionResult Post(MyDto dto)
    {
        // ModelState.IsValid is always true now
        return Ok();
    }
}

see also: https://learn.microsoft.com/en-us/aspnet/web-api/overview/advanced/configuring-aspnet-web-api and disable default validation in Asp.Net WebAPI

Answer 3

There is no ValidateInput attribute for web api that will disable validation, but you can easily define one that will reset the ModelState:

public class ValidateInput : ActionFilterAttribute
{
    private readonly bool _enableValidation;

    public ValidateInput(bool enableValidation)
    {
        _enableValidation = enableValidation;
    }

    public override void OnActionExecuting(HttpActionContext actionContext)
    {
        if(_enableValidation)
        {
            return;
        }

        if (!actionContext.ModelState.IsValid)
        {
            actionContext.ModelState.Clear();
        }
    }
}

And then use this in your controller:

public class SomeController : ApiController
{
    [ValidateInput(false)]
    public IHttpActionResult Post(MyDto dto)
    {
        // ModelState.IsValid is always true now
        return Ok();
    }
}

public class MyDto
{
    [Required]
    public int Id { get; set; }
}

Answer 4

In addition to @peco great answer this attribute will help if you will need to remove specific keys from ModelState:

public class ExceptPropertiesAttribute : ActionFilterAttribute
{
    private IEnumerable<string> _propertiesKeys;

    public ExceptPropertiesAttribute(string commaSeperatedPropertiesKeys)
    {
        if (!string.IsNullOrEmpty(commaSeperatedPropertiesKeys))
        {
            this._propertiesKeys = commaSeperatedPropertiesKeys.Split(',');
        }
    }

    public override void OnActionExecuting(ActionExecutingContext actionContext)
    {
        if (this._propertiesKeys != null)
        {
            foreach (var propertyKey in this._propertiesKeys)
            {
                if (actionContext.ModelState.ContainsKey(propertyKey))
                {
                    actionContext.ModelState.Remove(propertyKey);
                }
            }                
        }
    }
}

In addition, In .Net Core I can use ActionExecutingContext instead of HttpActionContext.

Usage:

[ExceptProperties("Id,Name")]
public ActionResult Post([FromBody] MyModelDTO itemDTO)
{
    //code
}

public ActionResult Put([FromBody] MyModelDTO itemDTO)
{
    //code
}