FromRoute parameters aren't URL Decoded.

[MicahZoltu]

[HttpGet]
[Route("")]
public async Task<IActionResult> GetValue([FromQuery(Name = "value")] String value) { ... }

[HttpGet]
[Route("{value}")]
public async Task<IActionResult> GetValue([FromRoute(Name = "value")] String value) { ... }

In the first example, a URL encoded string passed as the value query string parameter will be decoded before being passed into the GetValue function.

In the second example, a URL encoded string passed as a route segment will NOT be URL decoded before being passed to the GetValue function.

This behavior is unexpected, I would expect both Route and Query parameters to be URL decoded before being passed to the function.

If this is expected behavior, is there a workaround or a way to tell the route to decode before passing the parameter through? The problem is made more complex in my real world example because the route parameter is a URL and I want the parameter to be a Uri rather than a String. My current solution is to accept a String parameter and then construct a new Uri(value) out of it. However, this means I don't benefit from ModelState validation since the only a string is necessary to have the model state be valid.

[Eilon]

@Zoltu there was a bug in this in the past, but it was fixed in the RC1 release. I just tried it in the latest RC2 nightly builds and I don't see the bug for query strings or route data.

Can you clarify which build of ASP.NET Core you are using?

[MicahZoltu]

RC1 final. Il try with RC2 This evening and post here whether it resolves the issue or not.

[danroth27]

I am not able to reproduce this behavior on RC1 final. In both cases I see the model bound value as decoded.

[MicahZoltu]

@Eilon @danroth27

I just tested this again in a brand new ASPNET Core application created in Visual Studio 2015 using the Web template (https://docs.asp.net/en/latest/tutorials/your-first-aspnet-application.html). I added Swashbuckle (via NuGet) for easy testing and made both of the methods simply return Ok(value).

The working method, where the URL encoded string is in a query parameter:

The not working method, where the URL encoded string is in a route parameter:

You can see that Swashbuckle encoded the URL the same in both requests, just one in the query string and one in the route. However, the results from the two calls were different, despite the actions being the same except for the FromRoute/FromQuery attributes.

[Eilon]

@Zoltu thanks for the extra info, I'll have someone try this out and see what's going on here. Very odd.

[Eilon]

@ryanbrandenburg, a gift for you.

[ryanbrandenburg]

Hello @Zoltu! I did some investigation and found some interesting behaviors here.

The first thing I found was that in your example the route response was partially URL decoded. The only character which wasn't decoded was %2f, which is /. The other thing I learned was that you get this behavior only when self-hosting (that is, running the project without IISExpress), if you had launched this project from IISExpress you would have gotten different behavior, namely that your %2f's would be URL decoded before the route had been determined, meaning that for the URL http://localhost:5000/first%2fsecond and routes

[Route("{value}")]
public IActionResult GetValue([FromRoute(Name = "value")] string value)
...

[Route("{first}/{second}")]
public IActionResult Multi([FromRoute(Name = "first")] string first, [FromRoute(Name = "second")] string second)
...

you would hit GetValue when running self-hosted and Multi when running under IISExpress.

aspnet/KestrelHttpServer#124 appears to mention this behavior and it sounds like it's intentional (or at least known). @Tratcher and @troydai can hopefully confirm my reading of that.

If my reading was correct then I think the guidance would be not to use [FromRoute] on any values which are likely to contain %2f, and instead use [FromQuery] which will give you an entirely URL decoded string every time, regardless of which hosting method you're using.