`[FromRoute]` does not work when used as model property, not as action parameter.

[tvardero]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

[FromRoute] does not work when used as model property, not as action parameter (see reproduction).

1. Value for the property is set from the body.
   

2. Property generates validation error ("field is required"), if omitted on request (but route value is specified).
   
   

3. Swagger generates incorrect body schema for the model - [FromRoute] propery shown as a part of the body schema.
   

Expected Behavior

1. Parameter is mapped from route, not from the body.
2. Parameter does not generate 400 Bad Request result with model validation error, when parameter is missing in body.
3. Swagger gen schema generated properly - route parameter is not part of the body schema.

Steps To Reproduce

1. dotnet new webapi
2. Create new .cs file and paste this code:

using System.ComponentModel.DataAnnotations;
using Microsoft.AspNetCore.Mvc;

namespace Controllers;

[ApiController, Route("/Companies/{companyId}/[controller]")]
public class EmployeesController : ControllerBase
{
    [HttpPost]
    // [HttpPut] // Same result
    // [HttpPatch] // Same result
    public IActionResult CreateEmployee(CreateEmployeeDto dto)
    {
        return Ok(dto);
    }
}

public record CreateEmployeeDto
{
    [FromRoute]
    // [FromRoute(Name = "companyId")] // Same result
    public string CompanyId { get; init; } = null!;

    // [FromBody] // Same result
    // [FromForm] // Same result
    [Range(1, int.MaxValue)]
    public int PhoneNumber { get; init; }
}

3. Open swagger and test the action. Use different values for "companyId" for route value and for body parameter (to distinguish them).
   

Program.cs is untouched. You may remove WeatherController as you wish.

Exceptions (if any)

No response

.NET Version

6.0.403, 7.0.100

Anything else?

VS Code.

.NET SDK:
 Version:   7.0.100   
 Commit:    e12b7af219

Runtime Environment:  
 OS Name:     Windows
 OS Version:  10.0.19044
 OS Platform: Windows
 RID:         win10-x64
 Base Path:   C:\Program Files\dotnet\sdk\7.0.100\

Host:
  Version:      7.0.0
  Architecture: x64
  Commit:       d099f075e4

.NET SDKs installed:
  6.0.403 [C:\Program Files\dotnet\sdk]
  7.0.100 [C:\Program Files\dotnet\sdk]

.NET runtimes installed:
  Microsoft.AspNetCore.App 6.0.11 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 7.0.0 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 6.0.11 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 7.0.0 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.WindowsDesktop.App 6.0.11 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 7.0.0 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

Other architectures found:
  x86   [C:\Program Files (x86)\dotnet]

Environment variables:
  Not set

global.json file:
  Not found

[captainsafia]

Triage: @brunolins16 will look into this but it is likely that you need to add an attribute to the action parameter to opt-in to serializing the model from individual parameters.

[brunolins16]

@tvardero Thanks for contacting us. Api Controllers have a mechanism to infer parameters source when not explicitly specified, unfortunately this mechanism does not walk through the type to check if there is attributes specifying the source. Because of that, in your case, your parameter is detected as a complex type and the FromBody source is inferred, ignoring any other explicitly defined source.

In this case, you need to explicitly define a source for your parameter eg. FromQuery or FromForm.

Eg. :

public IActionResult CreateEmployee([FromQuery] CreateEmployeeDto dto)
    {
        return Ok(dto);
    } 

Obs. : The route attribute showing in Swagger is there because you have it in your route template, no because the defined property.

Hi @tvardero. We have added the "Needs: Author Feedback" label to this issue, which indicates that we have an open question for you before we can take further action. This issue will be closed automatically in 7 days if we do not hear back from you by then - please feel free to re-open it if you come back to this issue after that time.

[tvardero]

@brunolins16

Results are described as comments inside actions.
I have tested today with POST method only.

using Microsoft.AspNetCore.Mvc;

namespace Controllers;

public record Model
{
    public string NoAttributeParameter { get; init; } = null!;

    [FromBody]
    public string FromBodyParameter { get; init; } = null!;

    [FromQuery]
    public string FromQueryParameter { get; init; } = null!;

    [FromForm]
    public string FromFormParameter { get; init; } = null!;

    [FromRoute]
    public string FromRouteParameter { get; init; } = null!;
}

[ApiController, Route("api/[controller]/{fromRouteParameter}/[action]")]
public class TestController : ControllerBase
{
    // * - might be not ASP.NET problem, but Swashbuckle schema generator problem

    [HttpPost]
    public IActionResult WithNoAttribute(Model model)
    {
        // OK - "fromRouteParameter" is present in RouteData and is set correctly
        // Fail - FromRouteParameter of model was mapped from the body, which could contain different data or no data at all
        // Fail - 400 Bad request if FromRouteParameter is missing in the body
        // OK - "?fromQueryParameter" is present in Request.QueryString and is set correctly
        // Fail - FromQueryParameter of model was mapped from the body, which could contain different data or no data at all
        // Fail - 400 Bad request if FromQueryParameter is missing in the body
        // Fail* - FromQueryParameter is not present as query parameter in Swagger OpenAPI definition
        return Ok(model);
    }

    [HttpPost]
    public IActionResult WithFromBodyAttribute([FromBody] Model model)
    {
        // Same results as with WithNoAttribute action
        return Ok(model);
    }

    [HttpPost]
    public IActionResult WithFromFormAttribute([FromForm] Model model)
    {
        // FAIL - Unable to send JSON body: Bad Request 400 "The JSON value could not be converted to System.String. Path: $ | LineNumber: 0 | BytePositionInLine: 1."

        // Results with ConfigureApiBehaviorOptions(o => o.SuppressModelStateInvalidFilter = true):
        // FAIL - FromBodyParameter was not mapped (value is null)
        // FAIL - FromFormParameter was not mapped (value is null)
        // FAIL - NoAttributeParameter was not mapped (value is null)
        // FAIL - Unable to read from Request.Body stream - unable to seek to origin
        // FAIL* - Empty body schema in Swagger OpenAPI definition
        // OK - "fromRouteParameter" is present in RouteData and is set correctly
        // OK - FromRouteParameter of model was mapped from RouteData
        // OK - "?fromQueryParameter" is present in Request.QueryString and is set correctly
        // OK - FromQueryParameter of model was mapped from Request.QueryString

        return Ok(model);
    }

    [HttpPost]
    public IActionResult WithFromQueryAttribute([FromQuery] Model model)
    {
        // Same results as with WithFromFormAttribute action, except:
        // OK - NoAttributeParameter is mapped from query string and present in Swagger OpenAPI definition as query parameter

        return Ok(model);
    }

    [HttpPost]
    public IActionResult WithFromRouteAttribute([FromRoute] Model model)
    {
        // Same results as with WithFromFormAttribute action

        return Ok(model);
    }
}

OpenAPI definition:
https://pastebin.com/fgBHJUga

[tvardero]

I know that I can create something like that and it will work 100% fine:

[HttpPost]
public IActionResult SomeAction(
    [FromRoute] RouteModel routeModel,
    [FromQuery] QueryModel queryModel,
    [FromBody] BodyModel bodyModel)
{
    return Ok(new { routeModel, queryModel, bodyModel });
}

But my team lead think another way and requires all things to be put together as one class object.
This however does not work:

[HttpPost]
public IActionResult SomeAction(Model model)
{
    return Ok(model);
}

public record Model
{
    [FromRoute]
    public RouteModel RouteModel { get; init; }

    [FromQuery]
    public QueryModel QueryModel { get; init; }
    
    [FromBody]
    public BodyModel BodyModel { get; init; }
}

---

This post was EDITED on 11.12.2022 to reduce confusion.

[halter73]

Do you want the route parameter to override the property that's deserialized from the JSON body? What if the property is in the JSON body but not in the route (e.g. a request to /show given [HttpGet("show/{id?}")])? Should the value from the body be ignored? How would input formatters know to skip [FromRoute] properties?

Does [FromQuery] currently just overwrite model properties that could have been set by the input formatter? It doesn't surprise me that [FromForm] completely breaks things if you're trying to upload a JSON body.

[brunolins16]

I am a little bit confusing here.

In line with @halter73 questions. Are you QueryAndBodyModel expecting to be bound from body and source at same time?

    [FromQuery]
    QueryAndBodyModel QueryAndBodyModel { get; init; }

Ignoring the fact that you might want to bind the property from different source, your example doesn't work because of the mechanism that infer the binding source (#45392 (comment)).

Currently, the most common workarounds are:

• Disable parameter binding source inference: https://learn.microsoft.com/en-us/aspnet/core/web-api/?view=aspnetcore-7.0#disable-inference-rules-1, or
• Add an explict binding source: public IActionResult SomeAction([FromQuery]Model model)

That said, I believe this is a bad behavior and the infer mechanism could potentially no infer in this case since it will always get it wrong.

Obs.: I am still needed to review your examples (#45392 (comment)) to check what is expected or not.
Obs.: I believe it is just a typo but your properties must have a public getter be public to be evaluated by the Model Binding.