-
-
Notifications
You must be signed in to change notification settings - Fork 159
Closed
Labels
Description
Obfuscated IDs cannot be used with an atomic:operations request, because the deserializer attempts to convert the incoming id
JSON element value to TId
, bypassing any custom obfuscation logic. Instead, it should assign IIdentifiable.StringId
, without performing this validation upfront.
See usages of:
JsonApiDotNetCore/src/JsonApiDotNetCore/Serialization/RequestDeserializer.cs
Lines 266 to 279 in 4754049
private void AssertCompatibleId(IResourceIdentity resourceIdentity, Type idType) | |
{ | |
if (resourceIdentity.Id != null) | |
{ | |
try | |
{ | |
RuntimeTypeConverter.ConvertType(resourceIdentity.Id, idType); | |
} | |
catch (FormatException exception) | |
{ | |
throw new JsonApiSerializationException(null, exception.Message, null, AtomicOperationIndex); | |
} | |
} | |
} |