ValidateNever applied to action parameters is not honored

As part of MVC’s support for record types, ValidateNeverAttribute is now allowed to be applied to parameters. However, when applied to action parameters, the attribute has no effect and the parameter will continue to be validated.

[Neutrino-Sunset]

I’d like to take this opportunity to advocate for having this addressed.

I have a scenario in which an endpoint may receive a payload consisting of a large number (50k) of complex messages. The specification requires that messages whose validatation succeeds are processed, while messages whose validation fails are not processed, and a response with a custom format is generated which indicates which messages succeeded or failed along with any validation errors.

The ValidateNeverAttribute is one of the few ways to actually disable model validation. There are other approaches that ignore the results of validation, but these do not disable it. Ignoring the automatic validation is not an option in my case due to the performance implications of performing complex validation twice.

The fact that ValidateNeverAttribute doesn’t work for parameters means that in some cases the only way to use it is to apply it to a class. But if the class you wish to disable automatic validation for, is the same one you then need to perform manual validation on later, then you have a problem, since the ValidateNeverAttribute applied to the class also disables manual validation.

This is compounded by the fact that ControllerBase.TryValidateModel will recurse and validate a complete payload object graph, while Validator.TryValidateObject does not. The upshot of all this is that if you have a payload object containing nested objects that you wish to disable automatic validation of, but then perform manual validation of in the controller or service, you have no obvious solution at all. You face the prospect of disabling the builtin validation completely and coding something bespoke.

If ValidateNeverAttribute worked in such a way that you could apply it to an action method parameter and it would disable the automatic validation, but still allow you to run validation of the model manually via ControllerBase.TryValidateModel, then anything you wanted to do regarding validation would be possible and life would be rosy.

[ygoe]

I’m also surprised that the documentation contains content that has never been implemented.

My REST API application accepts a new model object in the POST method, but also a partial object in the PUT method so that only the set properties will be changed. That means I need a model class with Required attributes and an exact copy without them. Or I’ll just ditch ASP.NET Core model validation for its uselessness in real life and do it all myself. Looks like that’s what I have to do.

The default validation kicks in before the action is even called, so I cannot use any validation attributes that might be dynamic. Which is very often the case.