-
-
Notifications
You must be signed in to change notification settings - Fork 160
Closed
Labels
Description
Obfuscated IDs cannot be used with an atomic:operations request, because the deserializer attempts to convert the incoming id JSON element value to TId, bypassing any custom obfuscation logic. Instead, it should assign IIdentifiable.StringId, without performing this validation upfront.
See usages of:
JsonApiDotNetCore/src/JsonApiDotNetCore/Serialization/RequestDeserializer.cs
Lines 266 to 279 in 4754049
| private void AssertCompatibleId(IResourceIdentity resourceIdentity, Type idType) | |
| { | |
| if (resourceIdentity.Id != null) | |
| { | |
| try | |
| { | |
| RuntimeTypeConverter.ConvertType(resourceIdentity.Id, idType); | |
| } | |
| catch (FormatException exception) | |
| { | |
| throw new JsonApiSerializationException(null, exception.Message, null, AtomicOperationIndex); | |
| } | |
| } | |
| } |