dotnet / aspnetcore

ASP.NET Core is a cross-platform .NET framework for building modern cloud-based web applications on Windows, Mac, or Linux.
https://asp.net
MIT License
35.46k stars 10.03k forks source link

DefaultLinkGenerator Fast Clicking = [Debug] Failed to process the template #32104

Open cgountanis opened 3 years ago

cgountanis commented 3 years ago

Something more of an annoyance, possible bug? Clicking a SUBMIT with POSTBACK, including a screen lock on first click, when the page loads if you spam click the button to say, remove many items one at a time, one click per, you eventually get this strange DEBUG message and it boots you to logout. Some kind of SPAM protection or just a routing speed issue? I have tried hard naming the asp-area, asp-controller along with the action but it seems to happen randomly for end-users.

Yes our design could be better but this is a strange one. You can get the same action by hitting refresh too much on a single page as well. What am I doing wrong? Only is an issue when speed/spam clicking or spam refreshing.

Latest NET 5 CORE SDK 5.0.5, really nothing 3rd party. Just simple MVC with a touch of Razor.

<input asp-area="Utilities" asp-controller="UserManagement" asp-action="SomethingAssignment" type="submit"
2021-04-23 09:39:44.639 -05:00 [Debug] Failed to process the template "{area:exists}/{controller=Home}/{action=Index}/{id?}" for "Route: {area:exists}/{controller=Home}/{action=Index}/{id?}". A required route value is missing, or has a different value from the required default values. Supplied ambient values "{ \"action\": \"SomethingAssignment\", \"area\": \"Utilities\", \"controller\": \"UserManagement\", \"id\": \"ABC123\" }" and "{ \"action\": \"Index\", \"area\": \"\", \"controller\": \"Home\" }" with default values "{ \"action\": \"Index\", \"controller\": \"Home\" }" Areas.Utilities.Controllers.UserManagementController.SomethingAssignment(...) /Utilities/UserManagement/SomethingAssignment/ABC123Microsoft.AspNetCore.Routing.DefaultLinkGenerator
cgountanis commented 3 years ago

Misc details from Startup although does not seem to be a route config or MVC config w/antiforge issue.

app.UseEndpoints(endpoints =>
{
    endpoints.MapControllerRoute(
        name: "Areas",
        pattern: "{area:exists}/{controller=Home}/{action=Index}/{id?}");

    endpoints.MapControllerRoute(
        name: "default",
        pattern: "{controller=Home}/{action=Index}/{id?}");
});

// Add MVC service.
services.AddMvc()
    //.SetCompatibilityVersion(CompatibilityVersion.Version_3_0)
    .AddMvcOptions(options =>
    {
        // Configure global usage of antiforgery tokens.
        options.Filters.Add(new AutoValidateAntiforgeryTokenAttribute());
        options.MaxModelBindingCollectionSize = int.MaxValue;
    })
    .AddSessionStateTempDataProvider();
cgountanis commented 3 years ago

Feeling like it might be an AREA thing? Maybe it is jumping the gun and incorrectly parsing the the area MapControllerRoute and jumping to the default even though "required route value is missing" is not correct? Just freaking strange based on the DEBUG message.

ghost commented 3 years ago

Thanks for contacting us. We're moving this issue to the Next sprint planning milestone for future evaluation / consideration. Because it's not immediately obvious that this is a bug in our framework, we would like to keep this around to collect more feedback, which can later help us determine the impact of it. We will re-evaluate this issue, during our next planning meeting(s). If we later determine, that the issue has no community involvement, or it's very rare and low-impact issue, we will close it - so that the team can focus on more important and high impact issues. To learn more about what to expect next and how this issue will be handled you can read more about our triage process here.

cgountanis commented 3 years ago

Defiantly not a rare issue, just spam something, even just F5 and you get booted. Not a huge issue when talking about DDOS protection but the error logs listed are very much not that. Maybe an unintended security feature, haha?

ghost commented 3 years ago

We've moved this issue to the Backlog milestone. This means that it is not going to be worked on for the coming release. We will reassess the backlog following the current release and consider this item at that time. To learn more about our issue management process and to have better expectation regarding different types of issues you can read our Triage Process.