Giters

json-api-dotnet / JsonApiDotNetCore

A framework for building JSON:API compliant REST APIs using ASP.NET and Entity Framework Core.

Home Page:https://www.jsonapi.net

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Empty string ID is accepted in post resource request

bkoelman opened this issue · comments

commented 
{
    Data = new PlayerDataInPostRequest
    {
        Id = null!, // FIXME: passing "" here works fine 🤔
    }
}

Originally posted by @verdie-g in #1475 (comment)

Interesting! I've debugged it down to RuntimeTypeConverter, which returns the target type's default value for an empty string. And there are tests for that behavior. However, I have no idea why it works like that. It was introduced in #139, all the way back in 2017.

When removing that behavior, all the tests are still green. However this is a very risky thing to change.

@maurei does this ring any bells? What's happening here is that a client sends "data": { "id": "", ... } in a post resource request, with the configuration that client-generated IDs are required.

Originally posted by @bkoelman in #1475 (comment)

Read into it a little bit. It sounds familiar for sure, but it doesn't really ring a concrete bell at this moment... 🤷

Originally posted by @maurei in #1475 (comment)

commented

I'm afraid this bug has become a "feature", ie people may be relying on the current behavior and we shouldn't break them in a minor or patch release.