Minimal API Data Validation in .NET 10: A Deep Dive with Tim Corey

Tim Corey

10m 28s

Data validation is a critical aspect of API development. Without proper validation, software applications risk accepting malformed data, malicious data, or invalid requests, leading to data corruption, security vulnerabilities like SQL injection, cross-site scripting, and even buffer overflows. Ensuring that an incoming request is well-formed, contains the expected format, and respects the data types defined in your backend is key for data integrity, robust error handling, and developer trust.

In his video "Minimal API Data Validation Changes in .NET 10," Tim Corey walks through the API validation improvements in Minimal APIs, demonstrating how developers can enforce comprehensive validation on both classes and records. Tim explains not just how to prevent invalid data, but also how to reduce code duplication, streamline validation logic, and return proper HTTP status codes when validation fails. Let's follow Tim's walkthrough for a deeper understanding of data validation in Minimal APIs.

Introduction to Minimal API Validation

Tim Corey starts by highlighting that Minimal APIs in .NET 10 received multiple upgrades, with request validation being one of the key improvements. This allows incoming requests, whether through the query string, headers, or request body, to be automatically validated. Tim emphasizes that proper validation not only improves developer experience but also prevents malformed requests from reaching business logic, which is essential for maintaining data integrity and protecting sensitive information.

Tim also notes that his video is part of a quick 10-minute training series, intended to provide actionable guidance without diving too deep into abstract theory. He encourages viewers to download his source code to follow along.

Setting Up a Minimal API for Validation

To demonstrate validation rules, Tim sets up a minimal API from a file new project, simplifying it to focus on API validation. His example API includes:

• A Hello World endpoint for testing connectivity.
• A POST request /person endpoint that accepts a Person object.
• A POST request /login endpoint for a Login record.

Tim runs the API and shows that malformed data is initially accepted. For example, sending a blank Person object or an invalid email in the Login record still results in a successful API response. This demonstrates the need for schema validation and request validation to prevent invalid data from being processed in the backend.

Adding Validation Services to Minimal APIs

Tim explains that the first step in implementing proper validation is to register validation services in the API:

builder.Services.AddValidation();

builder.Services.AddValidation();

By adding this service, the route handlers automatically perform type checking, format validation, and content validation on incoming requests. Tim points out that this step is essential to ensure that validation failures generate error messages rather than allowing malicious data to bypass the system.

Validating Classes: Example with Person Model

Tim adds validation attributes to the Person class using System.ComponentModel.DataAnnotations. He marks properties as required and enforces format validation with minimum length constraints:

[Required]
[MinLength(2)]
public string FirstName { get; set; }

[Required]
[MinLength(2)]
public string LastName { get; set; }

[Required]
[MinLength(2)]
public string FirstName { get; set; }

[Required]
[MinLength(2)]
public string LastName { get; set; }

Running the API now triggers validation errors if the request body is missing required fields or contains malformed data. For instance, sending a single-character LastName produces a 400 Bad Request with a detailed error message:

"The field LastName must be a string or array type with a minimum length of 2."

Tim highlights that using validation libraries like this reduces code duplication and allows developers to focus on business logic rather than writing repetitive validation logic in each route handler.

Validating Records: Example with Login Record

Validating records differs slightly because their properties are defined in the constructor. Tim demonstrates how to enforce validation rules on records using the [property:] syntax:

public record Login(
    [property: Required, EmailAddress] string Email,
    [property: Required, MinLength(10)] string Password,
    [property: Compare(nameof(Password))] string ConfirmPassword
);

public record Login(
    [property: Required, EmailAddress] string Email,
    [property: Required, MinLength(10)] string Password,
    [property: Compare(nameof(Password))] string ConfirmPassword
);

Key points Tim explains:

• Email validation ensures the Email field follows the correct format.
• Minimum length on the password protects against malformed requests or weak passwords.
• [Compare(nameof(Password))] ensures ConfirmPassword matches the original Password, avoiding data corruption or validation failures in nested objects.

Tim runs the post request for the login endpoint and demonstrates that invalid email formats, short passwords, or mismatched confirmation passwords trigger validation errors automatically. Once the fields meet the expected format, the API response succeeds.

Pitfalls to Avoid: Accessibility Matters

Tim points out a subtle pitfall: validation fails silently if classes or records are not public. Even if the API request successfully binds to the object, validation results won't be enforced:

internal record Login(...); // Validation will not run

internal record Login(...); // Validation will not run

He explains that while malicious data or invalid input may still populate objects, the validation strategy is bypassed. This behavior is documented in ASP.NET Core, but Visual Studio does not warn developers, so it's crucial to regularly review validation rules and ensure all API models are public.

Advantages of Using Minimal API Validation

Tim concludes by summarizing the benefits of API data validation in Minimal APIs:

1. Eliminates manual validation logic: No need to write repetitive checks for each property.
2. Ensures data integrity: Prevents malformed requests from corrupting the backend or nested objects.
3. Improves security: Reduces exposure to malicious data, SQL injection, cross-site scripting, and other security vulnerabilities.
4. Provides clear error messages: Returns validation failures with error messages and proper HTTP status codes (like 400 Bad Request).
5. Enhances developer experience: Clean, declarative validation reduces code duplication and improves trust in API responses.
6. Supports comprehensive validation: Works on request body, query strings, headers, and nested objects automatically.

By following Tim's approach, developers can implement comprehensive validation without writing custom validator methods or repeating validation logic across multiple endpoints.

Conclusion

Tim Corey's video provides a practical, step-by-step guide for implementing API validation in Minimal APIs with .NET 10. From adding validation services to decorating classes and records with attributes, and understanding potential pitfalls, Tim demonstrates how to enforce data integrity, format validation, and error handling effectively.

Proper API data validation ensures that your REST API only processes well-formed requests, reducing risks from malicious data, SQL injection, cross-site scripting, and other security vulnerabilities. Using validation rules, schema validation, and proper validation strategy strengthens developer trust while maintaining a clean and secure backend.

By following Tim's guidance, developers can implement a robust, secure, and reliable validation pipeline, ensuring that every post request, every object, and every API request adheres to expected formats, safeguarding both the backend and the end user.