XML Schema validation for POST requests with ASP.NET WebAPI

Question

I am trying to find a solution to validate if XML data sent in a POST request are fulfilling a given custom XML schema.

If I use the XmlMediaTypeFormatter delivered with ASP.NET Web API I don't have a schema validation available, as far as I can see. For example: If I have a model type...

public class Order
{
    public string Code { get; set; }
    public int Quantity { get; set; }
}

...and a POST action in an ApiController...

public HttpResponseMessage Post(Order order)
{
    if (ModelState.IsValid)
    {
        // process order...
        // send 200 OK response for example
    }
    else
        // send 400 BadRequest response with ModelState errors in response body
}

...I can post the following "wrong" XML data and will get a 200 OK response nevertheless:

User-Agent: Fiddler
Host: localhost:45678
Content-Type: application/xml; charset=utf-8

<Order> <Code>12345</Nonsense> </Order>   // malformed XML

Or:

<Order> <CustomerName>12345</CustomerName> </Order>    // invalid property

Or:

<Customer> <Code>12345</Code> </Customer>    // invalid root

Or:

"Hello World"    // no XML at all

etc., etc.

The only point where I have a validation of the request is model binding: In request example 1, 3 and 4 the order passed into the Post method is null, in example 2 the order.Code property is null which I could invalidate by testing for order == null or by marking the Code property with a [Required] attribute. I could send this validation result back in the response with a 400 "BadRequest" Http status code and validation messages in the response body. But I cannot tell exactly what was wrong and can't distinguish between the wrong XML in example 1, 3 and 4 (no order has been posted, that's the only thing I can see) - for instance.

Requiring that an Order has to be posted with a specific custom XML schema, for example xmlns="http://test.org/OrderSchema.xsd", I would like to validate if the posted XML is valid with respect to this schema and, if not, send schema validation errors back in the response. To achieve this I have started with a custom MediaTypeFormatter:

public class MyXmlMediaTypeFormatter : MediaTypeFormatter
{
    // constructor, CanReadType, CanWriteType, ...

    public override Task<object> ReadFromStreamAsync(Type type, Stream stream,
        HttpContentHeaders contentHeaders, IFormatterLogger formatterLogger)
    {
        var task = Task.Factory.StartNew(() =>
        {
            using (var streamReader = new StreamReader(stream))
            {
                XDocument document = XDocument.Load(streamReader);
                // TODO: exceptions must the catched here,
                // for example due to malformed XML
                XmlSchemaSet schemaSet = new XmlSchemaSet();
                schemaSet.Add(null, "OrderSchema.xsd");

                var msgs = new List<string>();
                document.Validate(schemaSet, (s, e) => msgs.Add(e.Message));
                // msgs contains now the list of XML schema validation errors
                // I want to send back in the response
                if (msgs.Count == 0)
                {
                    var order = ... // deserialize XML to order
                    return (object)order;
                }
                else
                    // WHAT NOW ?
            }
        });
        return task;
    }
}

This works so far as long as everything is correct.

But I don't know what to do if msgs.Count > 0. How can I "transfer" this validation result list to the Post action or how can I create a Http response that contains those XML schema validation messages?

Also I am unsure if a custom MediaTypeFormatter is the best extensibility point for such a XML schema validation and if my approach isn't the wrong way. Would possibly a custom HttpMessageHandler/DelegatingHandler be a better place for this? Or is there perhaps something much simpler out of the box?

Answer 1

If I were doing this I wouldn't use the Formatter. The primary goal of a formatter is to convert a wire representation to a CLR type. Here you have an XML document that you want to validate against a schema which is a different task altogether.

I would suggest creating a new MessageHandler to do the validation. Derive from DelegatingHandler and if the content type is application/xml load the content into XDocument and validate. If it fails, then throw a HttpResponseException.

Just add your MessageHandler to the Configuration.MessageHandlers collection and you are set.

The problem with using a derived XmlMediaTypeFormatter is that you are now executing at some point embedded inside the ObjectContent code and it is likely to be tricky to cleanly exit out. Also, making XmlMediaTypeFormatter any more complex is probably not a great idea.

I had a stab at creating the MessageHandler. I did not actually try running this code, so buyer beware. Also, the task stuff gets pretty hairy if you avoid blocking the caller. Maybe someone will clean that code up for me, anyway here it is.

  public class SchemaValidationMessageHandler : DelegatingHandler {

        private XmlSchemaSet _schemaSet;
        public SchemaValidationMessageHandler() {

            _schemaSet = new XmlSchemaSet();
            _schemaSet.Add(null, "OrderSchema.xsd");
        }

        protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken) {

            if (request.Content != null && request.Content.Headers.ContentType.MediaType == "application/xml")
            {
                var tcs = new TaskCompletionSource<HttpResponseMessage>();

                var task =  request.Content.LoadIntoBufferAsync()  // I think this is needed so XmlMediaTypeFormatter will still have access to the content
                    .ContinueWith(t => {
                                      request.Content.ReadAsStreamAsync()
                                          .ContinueWith(t2 => {
                                                            var doc = XDocument.Load(t2.Result);
                                                            var msgs = new List<string>();
                                                            doc.Validate(_schemaSet, (s, e) => msgs.Add(e.Message));
                                                            if (msgs.Count > 0) {
                                                                var responseContent = new StringContent(String.Join(Environment.NewLine, msgs.ToArray()));
                                                                 tcs.TrySetException(new HttpResponseException(
                                                                    new HttpResponseMessage(HttpStatusCode.BadRequest) {
                                                                        Content = responseContent
                                                                    }));
                                                            } else {
                                                                tcs.TrySetResult(base.SendAsync(request, cancellationToken).Result);
                                                            }
                                                        });

                                  });
                return tcs.Task;
            } else {
                return base.SendAsync(request, cancellationToken);
            }

        }