ASP.NET Core Development Notes: Implementing Non-intrusive Parameter Validation Using ActionFilterAttribute

Introduction

In modern application development, ensuring the security and reliability of APIs is crucial.

Aspect-Oriented Programming (AOP) greatly enhances code modularity and maintainability by separating cross-cutting concerns (such as validation, logging, and exception handling) from the core business logic.

In ASP.NET Core, utilizing ActionFilterAttribute provides a convenient way to implement the principles of AOP, enabling custom validation in a concise and efficient manner.

This article will share how to validate client IDs by creating a ValidateClientAttribute and explore how this approach embodies the many advantages of AOP.

Use Case

The scenario for this article is within a single sign-on (SSO) authentication project I previously developed. The project was named IdentityServerLite, designed as a lightweight SSO solution referencing IdentityServer4. However, it was not yet fully refined, as I built it while simultaneously learning OAuth 2.0 and OpenID Connect, resulting in somewhat disorganized code. I may write a separate article later to introduce this SSO project in detail, and there are currently plans to refactor and open-source it.

In the SSO project, operations such as login, acquiring an AccessToken, and requesting a token all require validating whether the Client ID parameter provided by the user is valid. This logic involved some repetition, which led me to seek a more efficient way to implement this functionality.

Having previously applied Aspect-Oriented Programming (AOP) principles to implement non-intrusive audit logging, I utilized the same approach here to implement this validation feature.

ActionFilterAttribute

I noticed that my previous two articles on implementing audit logs didn't cover this topic in much detail.

Let's recap:

• Asp-Net-Core Development Notes: Implementing Dynamic Audit Log Functionality
• Asp-Net-Core Development Notes: Further Implementing Non-Intrusive Audit Log Functionality

Now, let's elaborate a bit more~

ActionFilterAttribute is a convenient tool provided by ASP.NET Core for adding custom logic before or after the execution of a controller's action method. This mechanism allows us to insert additional processing logic, such as validation, logging, exception handling, etc., without modifying the action method itself. This feature embodies the concept of Aspect-Oriented Programming (AOP), which effectively separates concerns and improves the modularity and maintainability of the code.

By inheriting from ActionFilterAttribute, you can override the OnActionExecuting and OnActionExecuted methods to execute custom logic before and after the action method runs. For example, validating the validity of input parameters, logging the execution time of requests, handling exceptions, and more.

Clarifying Thoughts (理清思路)

Features to Implement

• Validate whether the incoming Client ID parameter is valid based on configuration (the parameter name and its location are not fixed and require configuration).
• If validation fails, return error information.
• If validation passes, the corresponding Client object must be accessible within the interface.

How is it implemented?

First, it was determined that this feature would be added to the interface externally using an Attribute. The specific validation logic is implemented by overriding the OnActionExecutionAsync method of the ActionFilterAttribute.

Afterward, the Client object retrieved from the database needs to be saved into HttpContext so that it can be easily accessed within the interface.

HttpContext is an object in ASP.NET Core that encapsulates the HTTP request and response. It provides a unified way to access HTTP-specific information, including request details, response content, user information, session data, request headers, response headers, etc. Each HTTP request corresponds to an HttpContext instance, which persists throughout the entire lifecycle of the request processing.

Here, we use the Items key-value pair collection provided by HttpContext (used to share data between different middleware and components during the request) to share the Client object.

var client = HttpContext.Items["client"] as Client;

Start Writing Code

ClientIdSource Enum

The location of the Client ID is not fixed and needs to be configured when it is used.

Define an enum as follows:

public enum ClientIdSource {
  Query,
  Body,
  Route,
  Header
}

ValidateClientAttribute Implementation

Create the file ValidateClientAttribute.cs within the Filters directory.

Based on configuration, read the Client ID from a specified location using a designated parameter name, then query the database.

public class ValidateClientAttribute(
  ClientIdSource source = ClientIdSource.Query
) : ActionFilterAttribute {
  /// <summary>
  /// The parameter name for the Client ID. Note that this is the property name within the DTO, not the field name in the request body JSON.
  /// </summary>
  public string ParameterName { get; set; } = "client_id";

  /// <summary>
  /// Sets the key for the `Client` object stored in the `HttpContext.Items` collection after successful validation.
  /// </summary>
  public string ClientItemKey { get; set; } = "client";

  public override async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next) {
    var clientId = "";

    switch (source) {
      case ClientIdSource.Query:
        clientId = context.HttpContext.Request.Query[ParameterName];
        break;
      case ClientIdSource.Body:
        // Use reflection to read client_id from the request body.
        // The body read here is the first parameter of the Controller's Action method, typically a JSON data model from the request body bound to the corresponding DTO instance.
        var body = context.ActionArguments.Values.FirstOrDefault();
        if (body != null) {
          var clientProp = body.GetType().GetProperty(ParameterName);
          if (clientProp != null) {
            clientId = clientProp.GetValue(body) as string;
          }
        }
        break;
      case ClientIdSource.Route:
        clientId = context.RouteData.Values[ParameterName] as string;
        break;
      case ClientIdSource.Header:
        clientId = context.HttpContext.Request.Headers[ParameterName];
        break;
    }

    if (string.IsNullOrWhiteSpace(clientId)) {
      throw new ArgumentNullException(ParameterName);
    }

    var clientRepo = context.HttpContext.RequestServices.GetRequiredService<IBaseRepository<Client>>();
    var client = await clientRepo.Select.Where(a => a.ClientId == clientId).FirstAsync();

    if (client != null) {
      context.HttpContext.Items["client"] = client;
      await next();
    }
    else {
      context.Result = new NotFoundObjectResult(
        new ApiResponse { Message = $"client with id {clientId} not found" });
    }
  }
}

There are a few things to note, which are explained below.

Using Reflection to Obtain Request Body Parameters

The other parameter locations are relatively easy to obtain.

For POST or PUT methods, data is typically sent as JSON in the Request Body.

At this point, we could read the value of this Body, but after reading, we would have to parse the JSON ourselves and write the Stream back, which is quite cumbersome. Moreover, if the Body is in XML format, a different parsing method would be required.

Here, I used reflection to let the AspNetCore framework handle the Request Body. Then, I directly used reflection to read the Client ID based on the parameter name.

Usage

Here are some usage examples

Parameter is in the Body

The parameter name in the DTO is ClientId.

public class PwdLoginDto : LoginDto {
  [Required]
  [JsonPropertyName("username")]
  public string Username { get; set; }

  [Required]
  [JsonPropertyName("password")]
  public string Password { get; set; }
}

Usage in Interface

[HttpPost("login/password")]
[ValidateClient(ClientIdSource.Body, ParameterName = "ClientId")]
public async Task<IActionResult> LoginByPassword(PwdLoginDto dto) {

}

Parameters are in Query Params

The parameter name is client_id

[HttpGet("authorize/url")]
[ValidateClient(ClientIdSource.Query, ParameterName = "client_id")]
public ApiResponse<string> GetAuthorizeUrl([FromQuery] AuthorizeInput input) {
  return new ApiResponse<string>(GenerateAuthorizeUrl(input));
}

References

• https://learn.microsoft.com/en-us/aspnet/core/mvc/controllers/filters
• https://learn.microsoft.com/en-us/aspnet/core/fundamentals/http-context