Data validation checks incoming request data before processing it, ensuring that values are meaningful, accurate, secure, and acceptable to an endpoint. In an ASP.NET Core web API, validation works alongside model binding: the framework converts HTTP input to .NET types and applies validation rules. section 6.0 section 6.4
Validation can happen implicitly through framework conventions or explicitly through application rules:
- Model binding rejects values that cannot be converted to the expected type, such as a nonnumeric pageIndex value. section 6.1
- Built-in or custom data annotation attributes validate parameters and complex-type properties. section 6.4
- IValidatableObject supports cross-field rules when validity depends on multiple properties together. section 6.4 section 6.3.3
- ModelState collects validation results; [ApiController] can process them automatically, while manual checks allow a customized response. section 6.4
Rejecting an invalid pageIndex
A request such as /BoardGames?pageIndex=test fails before the controller action executes because pageIndex must be an integer. The API returns HTTP 400 Bad Request and identifies the rejected value, giving the client actionable validation feedback. section 6.1 section 6.2
{
"type":"https://tools.ietf.org/html/rfc7231#section-6.5.1",
"title":"One or more validation errors occurred.",
"status":400,
"traceId":"00-a074ebace7131af6561251496331fc65-ef1c633577161417-00",
"errors":{
"pageIndex":["The value 'string' is not valid."]
}
}
Inspect the structured validation response showing the status, error title, trace identifier, parameter name, and rejected value. section 6.1
Validation failures are part of normal client-server interaction rather than application exceptions. Combined with consistent error handling, they reduce risks associated with malformed input, data leaks, slowdowns, and other security or performance problems. section 6.0 section 6.4
