Preserve BadHttpRequestException status codes by halter73 · Pull Request #68632 · dotnet/aspnetcore

halter73 · 2026-08-19T02:08:06Z

ExceptionHandlerMiddleware currently converts BadHttpRequestException responses to 500, masking client errors such as invalid or incomplete request bodies. This change uses BadHttpRequestException.StatusCode by default, while retaining 500 as the default exception status code for all other exceptions.

A configured StatusCodeSelector still takes precedence, and custom ExceptionHandler delegates and IExceptionHandler services can continue overriding the selected status code. Status code 404 carried by BadHttpRequestException is treated as intentional rather than as a misconfigured exception handler response.

Fixes: #43831

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

This pull request updates ExceptionHandlerMiddleware so that when ExceptionHandlerOptions.StatusCodeSelector is not configured, BadHttpRequestException.StatusCode is preserved instead of being replaced by the default 500, preventing client-error status codes from being masked.

Changes:

Default status code selection now preserves BadHttpRequestException.StatusCode when StatusCodeSelector is null.
The “404 implies misconfigured exception handler” safeguard is adjusted to treat BadHttpRequestException 404 as intentional.
Unit tests and option documentation are updated to validate precedence/override behavior.

Show a summary per file

File	Description
src/Middleware/Diagnostics/src/ExceptionHandler/ExceptionHandlerMiddlewareImpl.cs	Updates default status code selection and 404 misconfiguration handling behavior.
src/Middleware/Diagnostics/src/ExceptionHandler/ExceptionHandlerOptions.cs	Updates `StatusCodeSelector` remarks to document `BadHttpRequestException.StatusCode` preservation.
src/Middleware/Diagnostics/test/UnitTests/ExceptionHandlerMiddlewareTest.cs	Adds coverage for preserved status codes and override precedence (selector/delegate/service).

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Files reviewed: 3/3 changed files
Comments generated: 1
Review effort level: Lite

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

javiercn · 2026-08-19T06:47:46Z

+            var is404FromBadHttpRequestException = edi.SourceException is
+                BadHttpRequestException { StatusCode: StatusCodes.Status404NotFound };


Move this right before its first use?

javiercn · 2026-08-19T15:47:59Z

/backport to release/11.0-rc1

github-actions · 2026-08-19T15:48:08Z

Started backporting to release/11.0-rc1 (link to workflow run)

* Preserve BadHttpRequestException status codes * Preserve exception handler 404 safeguard --------- Co-authored-by: Stephen Halter <halter73@gmail.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [SignalR] Reject duplicate SignalR upload stream IDs (#68525) (#68638) * Reject duplicate SignalR upload stream IDs * Simplify upload stream ownership cleanup * Avoid upload stream ownership allocations * Simplify upload stream registration ownership * Defer upload stream reader creation * Dispose cancellation source after binding failure * Reuse upload stream test helper --------- Co-authored-by: Javier Calvarro Nelson <jacalvar@microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 82e97f5a-a052-4dbe-9cf1-b62f45cf7ee2 * Honor all sign-in confirmation requirements after registration (#68631) (#68655) Co-authored-by: Brennan <brecon@microsoft.com> * Preserve BadHttpRequestException status codes (#68632) (#68649) * Preserve BadHttpRequestException status codes * Preserve exception handler 404 safeguard --------- Co-authored-by: Stephen Halter <halter73@gmail.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * SignInManager: return SignInResult.Failed for expired passkey session challenge (#67539) (#68654) Co-authored-by: Grant Totinov <granttotinov604@gmail.com> * Don't apply the CSRF verdict to remote authentication callbacks (#68669) * Don't apply the CSRF verdict to remote authentication callbacks A remote provider's callback (OIDC response_mode=form_post, WS-Federation) is a cross-site form POST by protocol design, so the auto-injected CSRF protection records an invalid IAntiforgeryValidationFeature verdict for it. The handler then throws while reading its own callback body, before any of its events can run, so apps have no way to opt out. Suppress the verdict while a remote handler owns the request, and restore it if the handler declines so the rest of the pipeline still sees it. Fixes #68666 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: cb987098-3301-465b-9a3d-2e63aabf43bd * test both antiforgery & csrf --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: cb987098-3301-465b-9a3d-2e63aabf43bd * Use model display names in Blazor input parsing errors (#68667) (#68688) * Use display attributes in input parsing errors * Address test coverage feedback from review. * Apply dedup cleanup from feedback. Co-authored-by: Ilona Tomkowicz <32700855+ilonatommy@users.noreply.github.com> * [release/11.0-rc1] Extract IsAuthenticated helper method (#68658) * Extract IsAuthenticated helper method Co-authored-by: Youssef1313 <31348972+Youssef1313@users.noreply.github.com> * Reorder using Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Youssef1313 <31348972+Youssef1313@users.noreply.github.com> * Use SecurityHelper for authentication revalidation Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Youssef1313 <31348972+Youssef1313@users.noreply.github.com> --------- Co-authored-by: Youssef1313 <youssefvictor00@gmail.com> Co-authored-by: Youssef1313 <31348972+Youssef1313@users.noreply.github.com> Co-authored-by: Milos Kotlar <kotlarmilos@gmail.com> * Fix InitialItemIndex viewport underfill for small items in big container or on window resize (#67936) (#68689) Co-authored-by: Ilona Tomkowicz <32700855+ilonatommy@users.noreply.github.com> * fix nullable<union> for openapi gen (#68665) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Javier Calvarro Nelson <jacalvar@microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Brennan <brecon@microsoft.com> Co-authored-by: Stephen Halter <halter73@gmail.com> Co-authored-by: Grant Totinov <granttotinov604@gmail.com> Co-authored-by: Korolev Dmitry <dmkorolev@microsoft.com> Co-authored-by: Ilona Tomkowicz <32700855+ilonatommy@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Youssef1313 <youssefvictor00@gmail.com> Co-authored-by: Youssef1313 <31348972+Youssef1313@users.noreply.github.com> Co-authored-by: Milos Kotlar <kotlarmilos@gmail.com> Co-authored-by: William Godbe <wigodbe@microsoft.com> Copilot-Session: 82e97f5a-a052-4dbe-9cf1-b62f45cf7ee2 Copilot-Session: cb987098-3301-465b-9a3d-2e63aabf43bd

Preserve BadHttpRequestException status codes

8c50e09

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot AI lite review requested due to automatic review settings August 19, 2026 02:08

halter73 requested a review from BrennanConroy as a code owner August 19, 2026 02:08

Copilot started reviewing on behalf of halter73 August 19, 2026 02:08 View session

halter73 requested a review from DamianEdwards August 19, 2026 02:09

Copilot AI reviewed Aug 19, 2026

View reviewed changes

Comment thread src/Middleware/Diagnostics/src/ExceptionHandler/ExceptionHandlerMiddlewareImpl.cs Outdated

Preserve exception handler 404 safeguard

c18d1a6

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

javiercn reviewed Aug 19, 2026

View reviewed changes

javiercn approved these changes Aug 19, 2026

View reviewed changes

DamianEdwards approved these changes Aug 19, 2026

View reviewed changes

javiercn merged commit e7c22bd into main Aug 19, 2026
25 checks passed

javiercn deleted the halter73-pass-through-bad-request-status-codes branch August 19, 2026 15:47

github-actions Bot mentioned this pull request Aug 19, 2026

[release/11.0-rc1] Preserve BadHttpRequestException status codes #68649

Merged

10 tasks

dotnet-maestro Bot mentioned this pull request Aug 20, 2026

[main] Source code updates from dotnet/aspnetcore dotnet/dotnet#8472

Merged

dotnet-milestone-bot Bot added this to the 12.0-preview1 milestone Aug 20, 2026

Navigation Menu

Uh oh!

Preserve BadHttpRequestException status codes - #68632

Preserve BadHttpRequestException status codes#68632
javiercn merged 2 commits into
mainfrom
halter73-pass-through-bad-request-status-codes

halter73 commented Aug 19, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

javiercn Aug 19, 2026

Uh oh!

Uh oh!

javiercn commented Aug 19, 2026

Uh oh!

github-actions Bot commented Aug 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		var is404FromBadHttpRequestException = edi.SourceException is
		BadHttpRequestException { StatusCode: StatusCodes.Status404NotFound };

Uh oh!

Conversation

halter73 commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

javiercn Aug 19, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

javiercn commented Aug 19, 2026

Uh oh!

github-actions Bot commented Aug 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

halter73 commented Aug 19, 2026 •

edited

Loading