HttpRequestMessageExtensions.CreateResponse<T> should not accept T==HttpStatusCode

In an audit of our code base, we found that there were many calls that looked like:
return Request.CreateResponse(HttpStatusCode.NotFound);
that, due to a refactor, were actually resolving to this:
HttpResponseMessage CreateResponse<T>(this HttpRequestMessage request, T value)
This would make the service return a 200 with a body that says "NotFound". This is clearly not the intent of the programmer.

Possible solutions would be:

1. Add a more specific extension that specifically targets HttpStatusCode (e.g.System.Net.Http.Formatting has one)
2. Throw if T is HttpStatusCode

[owenhuyn]

I don't exactly know if this is possible but you can add:
HttpResponseMessage CreateResponse(this HttpRequestMessage request, HttpStatusCode statusCode)

[larskuhtz]

I think, this method shouldn't exist in first place. If you give me a T without telling me anything about this T, how can you possibly expect me to turn this into a sensible response body?

It seems that the value for T is serialized as JSON and the content-type is set to application/json. If serialization results in a string, it is a security vulnerability.

I think, the fully generic CreateResponse<T> method should be deprecated in favor of something ala CreateResponse<T> where T : IHttpResponseBody.

[mkArtakMSFT]

Dupe of aspnet/Mvc#6952