Using `AddValidation` causes non-validated Minimal API endpoints to continue after parsing errors

[aelij]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

After adding validation to ASP.NET Core, Minimal API endpoints that used to return 400 on parsing errors, now return 400 and continue execution of the endpoint handler.

IMO this is a symptom of a more generic issue - when using AddEndpointFilterFactory and returning the next delegate as-is, the same problem occurs.

Expected Behavior

Return 400 and stop.

Steps To Reproduce

AddValidation issue:

builder.Services.AddValidation();
...
app.MapGet("/x/{id}", (Guid id) => 1);

AddEndpointFilterFactory issue:

app.MapGet("/x/{id}", (Guid id) => 1).AddEndpointFilterFactory((_, next) => next);

Both produce 400 + the response body 1 when the GUID is invalid.

Exceptions (if any)

No response

.NET Version

10.0.100

Anything else?

No response

[BrennanConroy]

Please provide a minimal repro app. Just tried this on 10.0 and it returns a 400 without running the minimal API as expected.

[aelij]

@BrennanConroy The repro above works. Here's the full program:

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddValidation();
var app = builder.Build();
app.MapGet("/x/{id}", (Guid id) => 1);
app.Run();

Note you should run it under a non-Development environment and provide an invalid GUID.

dotnet run -e DOTNET_ENVIRONMENT=x
curl -v http://localhost/x/y

Result:

* Host localhost:5037 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
*   Trying [::1]:5037...
* Connected to localhost (::1) port 5037
> GET /x/y HTTP/1.1
> Host: localhost:5037
> User-Agent: curl/8.7.1
> Accept: */*
> 
* Request completely sent off
< HTTP/1.1 400 Bad Request
< Content-Type: application/json; charset=utf-8
< Date: Fri, 14 Nov 2025 10:29:19 GMT
< Server: Kestrel
< Transfer-Encoding: chunked
< 
* Connection #0 to host localhost left intact
1

[marcominerva]

@captainsafia @BrennanConroy I was also able to reproduce the issue with this code:

#:sdk Microsoft.NET.Sdk.Web

var builder = WebApplication.CreateBuilder(args);

var app = builder.Build();

app.MapGet("/x/{id}", (Guid id) =>
{
    return 1;
})
// As soon as I add an EndpointFilterFactory, the endpoint will be executed
// even if there is a binding parameter error (i.e., an invalid Guid).
// This happens only when ASPNETCORE_ENVIRONMENT isn't Development.
.AddEndpointFilterFactory((_, next) =>
{
    return next;
});

app.Run();

So, the problem seems to be related to EndpointFilterFactory itself rather than to the Validation feature. If I run the code in a Development environment, I get the following error:

Microsoft.AspNetCore.Http.BadHttpRequestException: Failed to bind parameter "Guid id" from "12".
   at lambda_method4(Closure, Object, HttpContext)
   at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddlewareImpl.Invoke(HttpContext context)

Note that the issue also occurs with .NET 9 and .NET 8.

[aelij]

I also found a workaround:

var root = app.MapGroup("/").AddEndpointFilterFactory((_, next) => (EndpointFilterDelegate)next.Clone());
root.Map...

It's possible this is the cause:

aspnetcore/src/Http/Http.Extensions/src/RequestDelegateFactory.cs

Lines 501 to 507 in 9de03d5

	// The filter factories have run without modifying per-request behavior, we can skip running the pipeline.
	// If a plain old RequestDelegate was passed in (with no generic parameter), we can just return it back directly now.
	if (ReferenceEquals(initialFilteredInvocation, filteredInvocation))
	{
	return null;
	}