how to disable 400 Bad request's message body in Asp.Net Core web API in production environment?

Question

I have an Web API project with lots of the Controllers, Validators, Services and Repositories in asp.net core

I am going to disable all the 400 Bad requests message bodies (Validate a Property from a model or ...) on production mode due to the security

how I can do this in asp.net core 2.2 ?

This can be easily done, but what are you going to return if not HTTP400 for invalid inputs? This is something extremely common and I'd see absolutely no security benefit in changing it — Camilo Terevinto, Aug 16 '20 at 08:21
believe me, this is in _no conceivable way_ positively affect security at all. it's just gonna annoy the living daylights out of anyone ever trying to reproduce a bug on your live-servers. and make you look like someone who has no idea what they're doing to anyone taking over the project in the future. — Franz Gleichmann, Aug 16 '20 at 08:30
@CamiloTerevinto thank you for your response .actually I was the first opposition to this idea but they gave me this task and I have to do . I warned them several times that it is not good idea at all for making the web API with more security . just a bad request with message body : something is wrong ! . can you help for doing this ? — Masoud Shayan, Aug 16 '20 at 08:41
@Franz Gleichmann thank you for your response . I believe in you and you are right . I was at the same stage a few years ago and the same problems you mentioned . in a confusing state ... — Masoud Shayan, Aug 16 '20 at 08:45

score 0 · Answer 1 · answered Aug 17 '20 at 07:44

As others have pointed out in the comments, this probably isn't a good idea and it's unlikely to improve security if your error messages are properly designed.

But in case you would like this nonetheless, one way to do it is to implement an MVC action filter:

public class BadRequestEmptyBodyFilter : IActionFilter, IOrderedFilter
{
    public void OnActionExecuting(ActionExecutingContext context)
    {
        if (context.Result == null && !context.ModelState.IsValid)
        {
            context.Result = new ObjectResult(null)
            {
                StatusCode = StatusCodes.Status400BadRequest
            };
        }
    }

    public void OnActionExecuted(ActionExecutedContext context)
    {
        if (context.Exception != null || context.Result == null)
        {
            return;
        }

        var statusCodeResult = context.Result as IStatusCodeActionResult;
        if (statusCodeResult?.StatusCode == StatusCodes.Status400BadRequest)
        {
            context.Result = new ObjectResult(null)
            {
                StatusCode = StatusCodes.Status400BadRequest
            };
        }
    }

    // Set this to a large negative number so it runs early in the pipeline
    public int Order => -1000000;
}

Then register this in Startup. Also, you should set ApiBehaviorOptions.SuppressModelStateInvalidFilter to true to disable the default bad request filter:

services.AddMvc(options =>
    {
        options.Filters.Add<BadRequestEmptyBodyFilter>();
    })
    .SetCompatibilityVersion(CompatibilityVersion.Version_2_2)
    .ConfigureApiBehaviorOptions(options =>
    {
        options.SuppressModelStateInvalidFilter = true;
    });

how to disable 400 Bad request's message body in Asp.Net Core web API in production environment?

1 Answers1