Skip to content

LibraryConfigurationMiddleware invokes the pipeline twice on malformed libraryId #38

Description

@umerfaruk

Summary

When the `libraryId` route segment fails to parse as an int, the middleware calls `next(context)` but doesn't return, then falls through and calls `next(context)` again at the end of the method.

Details

`LibraryConfigurationMiddleware.Invoke` (src/Inshapardaz.Api/Infrastructure/Middleware/LibraryConfigurationMiddleware.cs:18-45):
```csharp
else if (!int.TryParse(libraryIdValue, out libraryId))
{
await next(context); // no return here
}

var library = await _libraryRepository.GetLibraryById(libraryId, CancellationToken.None);
...
await next(context); // executes again
```

Impact

For a request with a malformed `libraryId` and a side-effecting HTTP method (POST/PUT/DELETE), the controller action — and any command it dispatches — runs twice. This could mean duplicate writes, duplicate emails sent, etc.

Suggested fix

Add a `return;` immediately after the first `await next(context);` call in that branch.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions