Applying Validation for Queryable API in ASP.NET Web API OData

Write for InfoQ

In ASP.NET Web API OData, it is possible to enable OData query syntax for a particular action with the help of Queryable API as shown below

[Queryable]
public IQueryable<WorkItem> Get(int projectId)

However, if you expose the queryable action outside your organization, you should protect the service by adding a layer of protection with the help of query validation. Hongmei Ge, Program Manager, Microsoft recently examined the various scenarios where you can infuse validation in Queryable API.

The first scenario as pointed out by Hongmei is to only allow queries that contains $top and $skip using a property called AllowedQueryOptions as shown below

[Queryable(AllowedQueryOptions = AllowedQueryOptions.Skip | AllowedQueryOptions.Top)]
public IQueryable<WorkItem> Get(int projectId)

It is possible to limit the value for $top and $skip to 100 and 200 using MaxTop and MaxSkip property

[Queryable(MaxTop = 100)]
public IQueryable<WorkItem> Get(int projectId)

[Queryable(MaxSkip = 200)]
public IQueryable<WorkItem> Get(int projectId)

With the help of AllowedOrderbyProperties, you can order the results by Id propery because the order by arbitrary properties could be slow

[Queryable(AllowedOrderByProperties = "Id")]
public IQueryable<WorkItem> Get(int projectId)

If your clients use equal comparison inside the $filter, then you should validate it using AllowedLogicalOperators

[Queryable(AllowedLogicalOperators = AllowedLogicalOperators.Equal)]
public IQueryable<WorkItem> Get(int projectId)

It is possible to turn off arithmetic operations in $filter by setting the value of AllowedArithmeticOperators to None

[Queryable(AllowedArithmeticOperators = AllowedArithmeticOperators.None)]
public IQueryable<WorkItem> Get(int projectId)

You can limit the usage of function in $filter using AllowedFunctions property

[Queryable(AllowedFunctions = AllowedFunctions.StartsWith)]
public IQueryable<WorkItem> Get(int projectId)

The above code implies that only StartsWith function can be used in $filter.

Hongmei aslo demostrates query validation in advanced scenarios such as customizing default validation logic for $skip, $top, $orderby, $filter and the usage of ODataQueryOptions to validate the query.

Related Topics:

• Development
• ASP.NET Web API
• OData

We protect your privacy.