Version: 2.0.5-beta
This is a cool library! Very useful and much simpler than the full Microsoft OData package (which doesn't work on asp.net 3.0 at the moment). ❤️
Passing top=3a in the query string results in FormatException (probably from int.Parse), which then results in a HTTP 500 (internal server error) response.
This is misleading because you immediately go check your server logs for a bug, when in fact it's a bad client request... HTTP code should be 4xx.
In a similar way, you can pass bad parameters, e.g. non-existing field select=doesnotcompute and the query parameter just seems to be ignored and response is 200 with all fields selected.
This is not being super helpful and bugs can go unnoticed. I tried to make orderby=id desc work for a while before realising that it's not the correct syntax.
I suggest:
-
Be more robust and catch exceptions on bogus input better. E.g. if parsing a number (e.g. top or skip) use int.TryParse instead.
-
Validate parameter values: fields must exist, wrap-with supports specific values, enum values in filter should exist, etc.
-
When an error occurs because of bad parameter values, return a 400 Bad request response, so that it's clear where the error is (bonus point if you log a warning on the server with the exact reason why the parameter was unacceptable).
Version: 2.0.5-beta
This is a cool library! Very useful and much simpler than the full Microsoft OData package (which doesn't work on asp.net 3.0 at the moment). ❤️
Passing
top=3ain the query string results inFormatException(probably fromint.Parse), which then results in a HTTP 500 (internal server error) response.This is misleading because you immediately go check your server logs for a bug, when in fact it's a bad client request... HTTP code should be 4xx.
In a similar way, you can pass bad parameters, e.g. non-existing field
select=doesnotcomputeand the query parameter just seems to be ignored and response is 200 with all fields selected.This is not being super helpful and bugs can go unnoticed. I tried to make
orderby=id descwork for a while before realising that it's not the correct syntax.I suggest:
Be more robust and catch exceptions on bogus input better. E.g. if parsing a number (e.g.
toporskip) useint.TryParseinstead.Validate parameter values: fields must exist,
wrap-withsupports specific values, enum values in filter should exist, etc.When an error occurs because of bad parameter values, return a
400 Bad requestresponse, so that it's clear where the error is (bonus point if you log a warning on the server with the exact reason why the parameter was unacceptable).