.NET 8 ASP Versioning is allowing any version number to be passed in to api request and returns data.

[Cbutterfi]

Is there an existing issue for this?

• [X] I have searched the existing issues

Describe the bug

I only want routing for v1. any other integer version should 404. Currently I can pass through any integer and get back data as if it was calling v1. ex) GET https://somedomain/app/api/v25/resouce/641B3CAA-1229-4AC2-BA9A-73534B7E9D4C returns the same as https://somedomain/app/api/v1/resouce/641B3CAA-1229-4AC2-BA9A-73534B7E9D4C

Expected Behavior

only v1 should hit my v1 controller. v25, v2, v8, etc should all 404.

Steps To Reproduce

using fairly boiler plate setup

in startup: private void ConfigureApiVersioning(IServiceCollection services) { services .AddApiVersioning(options => { options.ReportApiVersions = true; }) .AddApiExplorer(options => { options.DefaultApiVersion = new ApiVersion(1, 0); const string groupNameFormat = "'v'VVV"; options.GroupNameFormat = groupNameFormat; options.SubstituteApiVersionInUrl = true; }); } In my controller: [ApiVersion("1.0")] [Route("v{api-version:apiVersion}/someResource")] [Produces("application/json")] [Consumes("application/json")] public class SomeController

Exceptions (if any)

No response

.NET Version

8.0.300

Anything else?

No response

[commonsensesoftware]

It appears you are migrating from an earlier version and you've missed adding .AddMvc(). This is required if you use controllers; otherwise, only Minimal APIs are enabled.

private void ConfigureApiVersioning(IServiceCollection services)
{
    services
        .AddApiVersioning(options => options.ReportApiVersions = true)
        .AddMvc() // required in 6.0+ for MVC Core with controllers
        .AddApiExplorer(options =>
         {
            options.DefaultApiVersion = new ApiVersion(1, 0);
            options.GroupNameFormat = "'v'VVV";
            options.SubstituteApiVersionInUrl = true;
         });
}

[Cbutterfi]

hey @commonsensesoftware, thanks for the reply. You are correct that we are migrating from .NET6. We do already have that line for .AddMvc()

I just spun up a fresh api and seem to be able to dupe this issue.

here is my program.cs `using Asp.Versioning;

var builder = WebApplication.CreateBuilder(args);

// Add services to the container.

builder.Services.AddControllers(); // Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle builder.Services.AddEndpointsApiExplorer(); builder.Services.AddSwaggerGen(); builder.Services.AddMvc(options => { options.EnableEndpointRouting = false; }); ConfigureApiVersioning(builder.Services); var app = builder.Build();

// Configure the HTTP request pipeline. if (app.Environment.IsDevelopment()) { app.UseSwagger(); app.UseSwaggerUI(); }

app.UseHttpsRedirection();

app.UseAuthorization(); app.UseMvc(options => {

});

app.MapControllers();

app.Run();

void ConfigureApiVersioning(IServiceCollection services) => services .AddApiVersioning(options => { options.ReportApiVersions = true; options.ApiVersionReader = new UrlSegmentApiVersionReader(); }) .AddApiExplorer(options => { options.DefaultApiVersion = new ApiVersion(1, 0); const string groupNameFormat = "'v'VVV"; options.GroupNameFormat = groupNameFormat; options.SubstituteApiVersionInUrl = true; });`

and here is the small change to the demo controller: `using Asp.Versioning; using Microsoft.AspNetCore.Mvc;

namespace NET8VersioningTest.Controllers { [ApiVersion("1.0")] [Route("v{api-version:apiVersion}/[controller]")] [ApiController] public class WeatherForecastController : ControllerBase`

Probably something dumb I am doing, but any suggestion would be greatly appreciated! thanks

[Cbutterfi]

this works actually.

Setting options.EnableEndpointRouting = True and removing the lines: app.UseMvc(options => {

});

fixed it.

Thanks for your time.

[commonsensesoftware]

I definitely would not recommend using the legacy IRouter implementation. There are problematic edge cases. Endpoint Routing has been the way for many years now.

I think there may be some confusion as to what is happening.

builder.Services.AddMvcCore(); // or .AddMvc()

is NOT the same as:

builder.Services.AddApiVersioning().AddMvc();

The first one brings in MVC Core (or full MVC). The second one adds MVC (Core) support for API Versioning.

[Cbutterfi]

Versioning was working for me in the sample WeatherForecast api I spun up, but wouldn't work in our actual project. I noticed that our Controller was missing the [APIController] Attribute. Once I added that attribute, versioning started to work great. Adding that attribute seems to round all of our existing 400-level responses down to a 400. Something else to chase down!