FromQuery Attribute Causes ModelState Issues When Name Specified

[developer-partners]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

The FromQuery attribute causes ModelState.IsValid to be false whe the Name property is used.

Following the example in the Microsoft's documentation page, https://learn.microsoft.com/en-us/aspnet/core/mvc/models/model-binding?view=aspnetcore-9.0, if the following complex object is used in query string parameters, the ModelState.IsValid will become false.

Expected Behavior

ModelState.IsValid should be true when query string parameter name is what is specified in the Name property of the FromQuery attribute.

Steps To Reproduce

1. Create the following class for using as a complex object in a controller endpoint query string parameters.

public class Instructor
{
    public int Id { get; set; }

    [FromQuery(Name = "Note")]
    public string? NoteFromQueryString { get; set; }

    // ...
}

2. Create an endpoint that uses the complex object from step 1 with [FromQuery] attribute.

[HttpGet]
public IActionResult Test([FromQuery] Instructor instructor)
{
     return Ok();
}

3. Call the endpoint using the following URL: /api/your-url?note=test

The response status code will automatically be 400. If you disable automatic ModelState validation, then check ModelState.IsValid, it will be false. Looking into ModelState object properties, it shows that the "note" key in ModelState is Unvalidated which is what causing ModelState.IsValid to be false.

It works if you remove the Name property from the FromQuery attribute like below:

public class Instructor
{
    public int Id { get; set; }

    [FromQuery]
    public string? NoteFromQueryString { get; set; }

    // ...
}

Exceptions (if any)

No response

.NET Version

8.0.202

Anything else?

IDE: VSCode

.NET SDK:
Version: 8.0.202
Commit: 25674bb2f4
Workload version: 8.0.200-manifests.8cf8de6d

Runtime Environment:
OS Name: Windows
OS Version: 10.0.22631
OS Platform: Windows
RID: win-x64
Base Path: C:\Program Files\dotnet\sdk\8.0.202\

.NET workloads installed:
[maui-windows]
Installation Source: VS 17.9.34701.34
Manifest Version: 8.0.7/8.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\8.0.100\microsoft.net.sdk.maui\8.0.7\WorkloadManifest.json
Install Type: FileBased

[maccatalyst]
Installation Source: VS 17.9.34701.34
Manifest Version: 17.2.8004/8.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\8.0.100\microsoft.net.sdk.maccatalyst\17.2.8004\WorkloadManifest.json
Install Type: FileBased

[ios]
Installation Source: VS 17.9.34701.34
Manifest Version: 17.2.8004/8.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\8.0.100\microsoft.net.sdk.ios\17.2.8004\WorkloadManifest.json
Install Type: FileBased

[android]
Installation Source: VS 17.9.34701.34
Manifest Version: 34.0.52/8.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\8.0.100\microsoft.net.sdk.android\34.0.52\WorkloadManifest.json
Install Type: FileBased

Host:
Version: 8.0.3
Architecture: x64
Commit: 9f4b1f5d66

.NET SDKs installed:
3.1.402 [C:\Program Files\dotnet\sdk]
6.0.200 [C:\Program Files\dotnet\sdk]
7.0.100-rc.2.22477.23 [C:\Program Files\dotnet\sdk]
8.0.202 [C:\Program Files\dotnet\sdk]

.NET runtimes installed:
Microsoft.AspNetCore.App 3.1.8 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 6.0.2 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 6.0.28 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 7.0.0-rc.2.22476.2 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 7.0.17 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 8.0.3 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.NETCore.App 3.1.8 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 6.0.2 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 6.0.28 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 7.0.0-rc.2.22472.3 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 7.0.17 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 8.0.3 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.WindowsDesktop.App 3.1.8 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 6.0.2 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 6.0.28 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 7.0.0-rc.2.22472.13 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 7.0.17 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 8.0.3 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

Other architectures found:
x86 [C:\Program Files (x86)\dotnet]
registered at [HKLM\SOFTWARE\dotnet\Setup\InstalledVersions\x86\InstallLocation]

Environment variables:
Not set

global.json file:
Not found

Learn more:
https://aka.ms/dotnet/info

Download .NET:
https://aka.ms/dotnet/download

[developer-partners]

Any updates on this issue?

[captainsafia]

@developer-partners Any chance you can provide a repro for this? I'm having trouble seeing the same behavior with the following app code:

using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddControllers();

var app = builder.Build();

app.MapControllers();

app.Run();

public class Instructor
{
    public int Id { get; set; }
    
    [FromQuery(Name = "Note")]
    public string? NoteFromQueryString { get; set; }
    
    // Additional properties if needed
}

[ApiController]
[Route("[controller]")]
public class TestController : ControllerBase
{
    [HttpGet]
    public IActionResult Test([FromQuery] Instructor instructor)
    {
        if (!ModelState.IsValid)
        {
            return BadRequest(ModelState);
        }

        return Ok(instructor);
    }
}

And the following request:

http "http://localhost:5111/Test?note=test"
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Date: Tue, 17 Dec 2024 23:02:33 GMT
Server: Kestrel
Transfer-Encoding: chunked

{
    "id": 0,
    "noteFromQueryString": "test"
}

[developer-partners]

@captainsafia it's strange. I created a new app. I tried reproducing it there, but it worked as expected. However, it doesn't work in the project I'm working on. There is no explanation why it's not working. ModelState just shows Unvalidated.

1. Is there a way to enable some additional logging to see what's going on?
2. When does usually ModelState value become Unvalidated?

[developer-partners]

@captainsafia I was able to collect additional logs by changing Logging:LogLevel:Microsoft.AspNetCore to Warning.

Here is my endpoint:

using Microsoft.AspNetCore.Mvc;

[ApiController]
public class TestController : ControllerBase
{
    [HttpGet("test/query-string")]
    public IActionResult Test([FromQuery] Instructor instructor)
    {
        return Ok();
    }
}

public class Instructor
{

    [FromQuery(Name = "Note")]
    public string? NoteFromQueryString { get; set; }
}

When I call my endpoint, I get 400 response:
GET: https://localhost:7034/test/query-string?note=abc

Here are debug level logs. I hope it helps with troubleshooting.

info: Microsoft.AspNetCore.Hosting.Diagnostics[1]
      Request starting HTTP/1.1 GET https://localhost:7034/test/query-string?note=abc - - -
Microsoft.AspNetCore.Hosting.Diagnostics: Information: Request starting HTTP/1.1 GET https://localhost:7034/test/query-string?note=abc - - -
dbug: Microsoft.AspNetCore.Routing.Matching.DfaMatcher[1001]
      2 candidate(s) found for the request path '/test/query-string'
Microsoft.AspNetCore.Routing.Matching.DfaMatcher: Debug: 2 candidate(s) found for the request path '/test/query-string'
dbug: Microsoft.AspNetCore.Routing.Matching.DfaMatcher[1005]
      Endpoint 'TestController.Test (DepositionPrep.Admin.Server)' with route pattern 'test/query-string' is valid for the request path '/test/query-string'
Microsoft.AspNetCore.Routing.Matching.DfaMatcher: Debug: Endpoint 'TestController.Test (DepositionPrep.Admin.Server)' with route pattern 'test/query-string' is valid for the request path '/test/query-string'
dbug: Microsoft.AspNetCore.Routing.Matching.DfaMatcher[1005]
      Endpoint 'Fallback {*path:nonfile}' with route pattern '{*path:nonfile}' is valid for the request path '/test/query-string'
Microsoft.AspNetCore.Routing.Matching.DfaMatcher: Debug: Endpoint 'Fallback {*path:nonfile}' with route pattern '{*path:nonfile}' is valid for the request path '/test/query-string'
dbug: Microsoft.AspNetCore.Routing.EndpointRoutingMiddleware[1]
      Request matched endpoint 'TestController.Test (DepositionPrep.Admin.Server)'
Microsoft.AspNetCore.Routing.EndpointRoutingMiddleware: Debug: Request matched endpoint 'TestController.Test (DepositionPrep.Admin.Server)'
dbug: Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware[15]
      Static files was skipped as the request already matched an endpoint.
Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware: Debug: Static files was skipped as the request already matched an endpoint.
dbug: Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware[15]
      Static files was skipped as the request already matched an endpoint.
Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware: Debug: Static files was skipped as the request already matched an endpoint.
info: Microsoft.AspNetCore.Routing.EndpointMiddleware[0]
      Executing endpoint 'TestController.Test (DepositionPrep.Admin.Server)'
Microsoft.AspNetCore.Routing.EndpointMiddleware: Information: Executing endpoint 'TestController.Test (DepositionPrep.Admin.Server)'
info: Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker[102]
      Route matched with {action = "Test", controller = "Test"}. Executing controller action with signature Microsoft.AspNetCore.Mvc.IActionResult Test(Instructor) on controller TestController (DepositionPrep.Admin.Server).
Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker: Information: Route matched with {action = "Test", controller = "Test"}. Executing controller action with signature Microsoft.AspNetCore.Mvc.IActionResult Test(Instructor) on controller TestController (DepositionPrep.Admin.Server).
dbug: Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker[1]
      Execution plan of authorization filters (in the following order): DepositionPrep.Admin.Server.Filters.CheckPermissionFilter
Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker: Debug: Execution plan of authorization filters (in the following order): DepositionPrep.Admin.Server.Filters.CheckPermissionFilter
dbug: Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker[1]
      Execution plan of resource filters (in the following order): None
Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker: Debug: Execution plan of resource filters (in the following order): None
dbug: Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker[1]
      Execution plan of action filters (in the following order): Microsoft.AspNetCore.Mvc.ModelBinding.UnsupportedContentTypeFilter (Order: -3000), Microsoft.AspNetCore.Mvc.Infrastructure.ModelStateInvalidFilter (Order: -2000)
Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker: Debug: Execution plan of action filters (in the following order): Microsoft.AspNetCore.Mvc.ModelBinding.UnsupportedContentTypeFilter (Order: -3000), Microsoft.AspNetCore.Mvc.Infrastructure.ModelStateInvalidFilter (Order: -2000)
dbug: Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker[1]
      Execution plan of exception filters (in the following order): None
Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker: Debug: Execution plan of exception filters (in the following order): None
dbug: Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker[1]
Execution plan of result filters (in the following order): Microsoft.AspNetCore.Mvc.Infrastructure.ClientErrorResultFilter (Order: -2000)
Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker: Debug: Execution plan of result filters (in the following order): Microsoft.AspNetCore.Mvc.Infrastructure.ClientErrorResultFilter (Order: -2000)
dbug: Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker[1]
      Executing controller factory for controller TestController (DepositionPrep.Admin.Server)
Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker: Debug: Executing controller factory for controller TestController (DepositionPrep.Admin.Server)
dbug: Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker[2]
      Executed controller factory for controller TestController (DepositionPrep.Admin.Server)
Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker: Debug: Executed controller factory for controller TestController (DepositionPrep.Admin.Server)
dbug: Microsoft.AspNetCore.Mvc.ModelBinding.ParameterBinder[22]
      Attempting to bind parameter 'instructor' of type 'Instructor' ...
Microsoft.AspNetCore.Mvc.ModelBinding.ParameterBinder: Debug: Attempting to bind parameter 'instructor' of type 'Instructor' ...
dbug: Microsoft.AspNetCore.Mvc.ModelBinding.Binders.ComplexObjectModelBinder[44]
      Attempting to bind parameter 'instructor' of type 'Instructor' using the name '' in request data ...
Microsoft.AspNetCore.Mvc.ModelBinding.Binders.ComplexObjectModelBinder: Debug: Attempting to bind parameter 'instructor' of type 'Instructor' using the name '' in request data ...
dbug: Microsoft.AspNetCore.Mvc.ModelBinding.Binders.SimpleTypeModelBinder[13]
      Attempting to bind property 'Instructor.NoteFromQueryString' of type 'System.String' using the name 'Note' in request data ...
Microsoft.AspNetCore.Mvc.ModelBinding.Binders.SimpleTypeModelBinder: Debug: Attempting to bind property 'Instructor.NoteFromQueryString' of type 'System.String' using the name 'Note' in request data ...
dbug: Microsoft.AspNetCore.Mvc.ModelBinding.Binders.SimpleTypeModelBinder[14]
      Done attempting to bind property 'Instructor.NoteFromQueryString' of type 'System.String'.
Microsoft.AspNetCore.Mvc.ModelBinding.Binders.SimpleTypeModelBinder: Debug: Done attempting to bind property 'Instructor.NoteFromQueryString' of type 'System.String'.
dbug: Microsoft.AspNetCore.Mvc.ModelBinding.Binders.ComplexObjectModelBinder[45]
      Done attempting to bind parameter 'instructor' of type 'Instructor'.
Microsoft.AspNetCore.Mvc.ModelBinding.Binders.ComplexObjectModelBinder: Debug: Done attempting to bind parameter 'instructor' of type 'Instructor'.
dbug: Microsoft.AspNetCore.Mvc.ModelBinding.ParameterBinder[23]
      Done attempting to bind parameter 'instructor' of type 'Instructor'.
Microsoft.AspNetCore.Mvc.ModelBinding.ParameterBinder: Debug: Done attempting to bind parameter 'instructor' of type 'Instructor'.
dbug: Microsoft.AspNetCore.Mvc.ModelBinding.ParameterBinder[26]
      Attempting to validate the bound parameter 'instructor' of type 'Instructor' ...
Microsoft.AspNetCore.Mvc.ModelBinding.ParameterBinder: Debug: Attempting to validate the bound parameter 'instructor' of type 'Instructor' ...
dbug: Microsoft.AspNetCore.Mvc.ModelBinding.ParameterBinder[27]
      Done attempting to validate the bound parameter 'instructor' of type 'Instructor'.
Microsoft.AspNetCore.Mvc.ModelBinding.ParameterBinder: Debug: Done attempting to validate the bound parameter 'instructor' of type 'Instructor'.
dbug: Microsoft.AspNetCore.Mvc.Infrastructure.ModelStateInvalidFilter[1]
      The request has model state errors, returning an error response.
Microsoft.AspNetCore.Mvc.Infrastructure.ModelStateInvalidFilter: Debug: The request has model state errors, returning an error response.
dbug: Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker[63]
      Request was short circuited at action filter 'Microsoft.AspNetCore.Mvc.Infrastructure.ModelStateInvalidFilter'.
Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker: Debug: Request was short circuited at action filter 'Microsoft.AspNetCore.Mvc.Infrastructure.ModelStateInvalidFilter'.
dbug: Microsoft.AspNetCore.Mvc.Infrastructure.DefaultOutputFormatterSelector[11]
List of registered output formatters, in the following order: Microsoft.AspNetCore.Mvc.Formatters.HttpNoContentOutputFormatter, Microsoft.AspNetCore.Mvc.Formatters.StringOutputFormatter, Microsoft.AspNetCore.Mvc.Formatters.StreamOutputFormatter, Microsoft.AspNetCore.Mvc.Formatters.SystemTextJsonOutputFormatter
Microsoft.AspNetCore.Mvc.Infrastructure.DefaultOutputFormatterSelector: Debug: List of registered output formatters, in the following order: Microsoft.AspNetCore.Mvc.Formatters.HttpNoContentOutputFormatter, Microsoft.AspNetCore.Mvc.Formatters.StringOutputFormatter, Microsoft.AspNetCore.Mvc.Formatters.StreamOutputFormatter, Microsoft.AspNetCore.Mvc.Formatters.SystemTextJsonOutputFormatter
dbug: Microsoft.AspNetCore.Mvc.Infrastructure.DefaultOutputFormatterSelector[4]
      No information found on request to perform content negotiation.
Microsoft.AspNetCore.Mvc.Infrastructure.DefaultOutputFormatterSelector: Debug: No information found on request to perform content negotiation.
dbug: Microsoft.AspNetCore.Mvc.Infrastructure.DefaultOutputFormatterSelector[9]
      Attempting to select the first output formatter in the output formatters list which supports a content type from the explicitly specified content types 'application/problem+json, application/problem+xml, application/problem+json, application/problem+xml'.
Microsoft.AspNetCore.Mvc.Infrastructure.DefaultOutputFormatterSelector: Debug: Attempting to select the first output formatter in the output formatters list which supports a content type from the explicitly specified content types 'application/problem+json, application/problem+xml, application/problem+json, application/problem+xml'.
dbug: Microsoft.AspNetCore.Mvc.Infrastructure.DefaultOutputFormatterSelector[2]
      Selected output formatter 'Microsoft.AspNetCore.Mvc.Formatters.SystemTextJsonOutputFormatter' and content type 'application/problem+json' to write the response.
Microsoft.AspNetCore.Mvc.Infrastructure.DefaultOutputFormatterSelector: Debug: Selected output formatter 'Microsoft.AspNetCore.Mvc.Formatters.SystemTextJsonOutputFormatter' and content type 'application/problem+json' to write the response.
info: Microsoft.AspNetCore.Mvc.Infrastructure.ObjectResultExecutor[1]
      Executing BadRequestObjectResult, writing value of type 'Microsoft.AspNetCore.Mvc.ValidationProblemDetails'.
Microsoft.AspNetCore.Mvc.Infrastructure.ObjectResultExecutor: Information: Executing BadRequestObjectResult, writing value of type 'Microsoft.AspNetCore.Mvc.ValidationProblemDetails'.
info: Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker[105]
      Executed action TestController.Test (DepositionPrep.Admin.Server) in 41.4166ms
Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker: Information: Executed action TestController.Test (DepositionPrep.Admin.Server) in 41.4166ms
info: Microsoft.AspNetCore.Routing.EndpointMiddleware[1]
      Executed endpoint 'TestController.Test (DepositionPrep.Admin.Server)'
Microsoft.AspNetCore.Routing.EndpointMiddleware: Information: Executed endpoint 'TestController.Test (DepositionPrep.Admin.Server)'
dbug: Microsoft.AspNetCore.Server.Kestrel.Connections[9]
      Connection id "0HN90DVCBI6IU" completed keep alive response.
Microsoft.AspNetCore.Server.Kestrel.Connections: Debug: Connection id "0HN90DVCBI6IU" completed keep alive response.
info: Microsoft.AspNetCore.Hosting.Diagnostics[2]
      Request finished HTTP/1.1 GET https://localhost:7034/test/query-string?note=abc - 400 - application/problem+json;+charset=utf-8 95.1068ms
Microsoft.AspNetCore.Hosting.Diagnostics: Information: Request finished HTTP/1.1 GET https://localhost:7034/test/query-string?note=abc - 400 - application/problem+json;+charset=utf-8 95.1068ms

[developer-partners]

Any updates on this issue? The FromQuery attribute just doesn't work for us without any error messages that explain what's wrong.

[developer-partners]

Just following up to see if there any updates for this issue. Thanks

[captainsafia]

@developer-partners Thanks for getting the additional logs here. There doesn't seem to be anything unusual there. Specifically, I see:

>       Attempting to bind property 'Instructor.NoteFromQueryString' of type 'System.String' using the name 'Note' in request data ...

So, it does seem like the binding layer is attempting to resolve the string parameter from the correct query name.

A couple more ideas to look into:

• Are you able to share any customizations you have configured in your startup code that might be impacting the behavior here?
• I had assumed but just to be explicit, the error does not reproduce if no Name is provided in the Query attribute, correct?

[developer-partners]

@captainsafia found the issue. The problem is with SystemTextJsonValidationMetadataProvider. We had the following in our startup code:

builder.Services.AddControllers(options =>
{
    options.ModelMetadataDetailsProviders.Add(new SystemTextJsonValidationMetadataProvider());
});

After removing SystemTextJsonValidationMetadataProvider, it woks, so the issue is in SystemTextJsonValidationMetadataProvider.