ASP0019 should not fire if code guards with ContainsKey()

[martincostello]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

The new ASP0019 code analysis warning fires when the IHeaderDictionary.Append() method is used, even if the code uses the ContainsKey() method to check if the header is not already present before it is called.

if (!context.Response.Headers.ContainsKey("X-Frame-Options"))
{
    context.Response.Headers.Add("X-Frame-Options", "DENY");
}

ASP0019: Use IHeaderDictionary.Append or the indexer to append or set headers. IDictionary.Add will throw an ArgumentException when attempting to add a duplicate key.

Expected Behavior

No warning as the code has an appropriate guard clause.

Steps To Reproduce

Add a middleware with the following code to an ASP.NET Core 8 application:

public Task Invoke(RequestDelegate next, HttpContext context)
{
    context.Response.OnStarting(() =>
    {
        if (!context.Response.Headers.ContainsKey("X-Frame-Options"))
        {
            context.Response.Headers.Add("X-Frame-Options", "DENY");
        }

        return Task.CompletedTask;
    });

    return next(context);
}

Exceptions (if any)

N/A

.NET Version

8.0.100-preview.1.23115.2

Anything else?

No response

[adityamandaleeka]

Triage: this analyzer is very useful for people who are migrating from System.Web (because of the behavior change in Add), but it looks like there will be cases like this where working/correct code triggers this warning.

We should move this analyzer to be in the migration repo or otherwise enabled in migration scenarios only.

[Tratcher]

I think this analyzer is still relevant in aspnetcore and should stay here. You're right that the guard clause makes the Add safe in this instance, but our guidance is that Add should be avoided completely so the app uses consistent APIs to set headers. There is no advantage to using Add instead of the indexer, only downsides.

[adityamandaleeka]

Closing this issue for now based on the above.