ConsumesAttributes accepts requests without content type

[amrmahdi]

Is this a Bug or Feature request?:

Bug ?

Steps to reproduce (preferably a link to a GitHub repo with a repro project):

Define an action decorated with a specific content type, and send a request with no content type header.

Description of the problem:

We are using the ConsumesAttribute to constraint the content types an action accepts. We found out that if there is not content type header is sent, the action still gets the requests.

Looking at the attribute code, I can see that the validation only happens if the content type is not null

Mvc/src/Microsoft.AspNetCore.Mvc.Core/ConsumesAttribute.cs

Line 82 in fbae57c

if (requestContentType != null && !IsSubsetOfAnyContentType(requestContentType))

Should the request be reqjected if the content type is null ?

Version of Microsoft.AspNetCore.Mvc or Microsoft.AspNetCore.App or Microsoft.AspNetCore.All:

2.1.2

[mkArtakMSFT]

@rynowak, do you think this fix should go behind a back compat switch?
/cc @danroth27

[rynowak]

No, I don't this is high profile enough for a compat switch.