C# Web Api action method automatically decoding query parameter

Question

I have a C# Web Api end point in a controller that has a parameter. This parameter accepts an encrypted string and this string will contain characters like "/", "&", "+" etc. So whenever I call my Api endpoint from javascript, I encode it using encodeURIComponent function. Since I am expecting an encoded string I used HttpUtility.UrlDecode in my Web Api code, to decode and use it in my app.

public HttpActionResult MyAction(string encodedString)
{
    string decodedString = HttpUtility.UrlDecode(encodedString);
    // Process request
}

To check whether the code works as expected I started debugging by sending encoded strings as input. To my astonishment, I found that the input parameter already decodes on its own and pass it in the action method. This worked fine with the decoder method I have used, but started breaking when there was a "+" character. when I pass a string with "+" character the decoder method changed it to a blank space.

for e.g. passing djdh67-y&+dsdj to decoder changed to djdh67-y& dsdj

There were two surprises for me. First, why did the parameter got decoded on it own and second, why did the "+" character got decoded to a blank space? I cannot use this code until I understand what is happening because there might be surprises later (maybe automatic decoding stops) which will not be good.

Can someone explain me what exactly is happening or what is the best way to solve this problem?

Answer 1

To solve the proble just get rid of the HttpUtility.UrlDecode(encodedString) part.

The value that is coming to the action has been already decoded and you don't need to decode it second time.

In your example:

encodeURIComponent("djdh67-y&+dsdj")        -> djdh67-y%26%2Bdsdj // sent
HttpUtility.UrlDecode("djdh67-y%26%2Bdsdj") -> djdh67-y&+dsdj     // done
HttpUtility.UrlDecode("djdh67-y&+dsdj")     -> djdh67-y& dsdj     // wrong

Not encoded values in GET can be incorrectly interpret by the browser. e.g. symbol & in the request string means next parameter. That's why MVC "thinks" that every get parameter is encoded and decodes it.

In case when string is required in non-changed state it should be passed in the body of a POST request.