Requests with unsupported version don't return 4xx error code

[heorhi-kaubaska]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

Request with any api-version is handled by controller and there are no api-supported-versions header in response despite ReportApiVersions is set to true.
I used the Basic example with slight changes to reproduce the issue.
A successful status code is returned no matter which version is sent:
✔️ v1.0

❌ v2.0

❌ v9999

Expected Behavior

Request with unsupported version should return 4xx status code

Steps To Reproduce

.csproj file

<Project Sdk="Microsoft.NET.Sdk.Web">
  <PropertyGroup>
    <TargetFramework>net6.0</TargetFramework>
    <Nullable>enable</Nullable>
    <ImplicitUsings>enable</ImplicitUsings>
  </PropertyGroup>
  <ItemGroup>
    <PackageReference Include="Asp.Versioning.Mvc" Version="6.2.1" />
  </ItemGroup>
</Project>

Program.cs

var builder = WebApplication.CreateBuilder( args );

// Add services to the container.

builder.Services.AddControllers();
builder.Services.AddApiVersioning(
        options =>
        {
            // reporting api versions will return the headers
            // "api-supported-versions" and "api-deprecated-versions"
            options.ReportApiVersions = true;
        } )
    .AddMvc();

var app = builder.Build();

// Configure the HTTP request pipeline.

app.UseHttpsRedirection();
app.UseAuthorization();
app.MapControllers();
app.Run();

TestController.cs

using Asp.Versioning;
using Microsoft.AspNetCore.Mvc;

namespace ApiVersioningTest;

[ApiVersion("1.0")]
[Route( "api/v{version:apiVersion}/test" )]
public class TestController : ControllerBase
{
    [HttpGet("version")]
    public IActionResult Versioned(ApiVersion apiVersion)
    {
        return Ok(apiVersion);
    }
}

Exceptions (if any)

No response

.NET Version

6.0.301

Anything else?

No response

[commonsensesoftware]

The first problem is because TestController is not actually an API controller. It's missing [ApiController]. The attribute can also be applied on the entire assembly, but I don't see that and most people don't realize you can do that. Since TestController is not treated as an API controller, [ApiVersion] has no meaning; it's pure metadata. The apiVersion route constraint will allow any valid ApiVersion.

Reporting supported and deprecated API versions is dependent on getting to a candidate to use its metadata. Necessary changes in the routing policy may now eliminate candidates before there's any chance to retrieve metadata. This currently makes it impossible to report anything in some cases - mostly notably when something could exist, but doesn't. This change was needed to fix other issues related to 405, 406, and 415. This change was called out months ago in the roadmap and release notes. #876 is tracking a similar request. This is a difficult problem to solve. The only thing to go by in the request is the API version, but different APIs can have overlapping versions that don't necessarily have the version sets.

Since you're versioning by URL segment (the un-RESTful way), there was also a fix in Asp.Versioning.Http 6.2.2 that addresses a scenario where you'll get 400 instead of 404. The URL is the identifier so if no API versions are detected in it, then it should be treated as 404.

[commonsensesoftware]

This is fixed in 6.3.x and 7.0.0-*