Aspnetcore: Model binding failure should return friendlier message with option to customize it

Created on 23 Jul 2019 · 6Comments · Source: dotnet/aspnetcore

Description

Model binding fails due to try parse whitespaced string to decimal property and exposing sensitive info to client.

To Reproduce

Steps to reproduce the behavior:

I have very simple ApiController:

[ApiController]
public class ProductsController
{
    [HttpPost]
    public IActionResult Post([FromBody]CreateProductDto model)
    {    
        model.Id = await service.CreateProduct(model);

        return CreatedAtRoute(
            routeName: "GetProduct", 
            routeValues: new { id = model.Id }, 
            value: model
        );
    }
}

And model:

public class CreateProductDto
{
    [Required(ErrorMessage = "Invalid value")]
    public decimal totalPrice { get; set;}

    public int count { get; set; }
}

And posting json:
{ "totalPrice": " ", "count": " " }
And the following model state error is returned:
totalPrice: ["Could not convert string to decimal: . Path 'totalPrice', line 1, position 71."] 0: "Could not convert string to decimal: . Path 'totalPrice', line 1, position 71."

Expected behavior

Expected more user friendly message which can be exposed to api client when validating input.

Tried possible solutions

To make model fields strings and then parse and validate them. (not cool solution)
To use Mvc Options.ModelBindingMessageProvider if applicable, but doesn't for that specific case. Would be pretty cool if can.
To use IValidatableObject - as the binding fails before constructing the model, this is not possible.
Using Validatation Attribute - same as above. Model binding fails before that.

Additional info

NET Core SDK (reflecting any global.json):
 Version:   2.1.701
 Commit:    8cf7278aa1

Runtime Environment:
 OS Name:     fedora
 OS Version:  30
 OS Platform: Linux
 RID:         fedora.30-x64
 Base Path:   /usr/share/dotnet/sdk/2.1.701/

Host (useful for support):
  Version: 2.1.12
  Commit:  ccea2e606d

.NET Core SDKs installed:
  2.1.701 [/usr/share/dotnet/sdk]

.NET Core runtimes installed:
  Microsoft.AspNetCore.All 2.1.12 [/usr/share/dotnet/shared/Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.App 2.1.12 [/usr/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 2.1.12 [/usr/share/dotnet/shared/Microsoft.NETCore.App]

External area-mvc enhancement feature-Model-Binding

Source