Why does HttpRequestValidationException have a 500 http error code instead of 400?

Question

When I tested my MVC5-based web application, I found that it HttpRequestValidationExceptionreturned 500 of GetHttpCode().
I will catch this exception while checking the security of requests to the server. MVC checks the request and throws this exception, I processed it in Application_Errorand got 500 code returned, but, in fact, if the user went through the wrong login to the server I should return 400 errors (bad request). therefore, I don’t understand why the exception has 500 errors. Where am I mistaken?

Answer 1

, 500 .

• , , HttpRequestValidationException, . , - , , , . , , , , , ( ) , , , 4xx 5xx 5xx - ( , ).

• , , 4xx ( 404 , 404 , ). , 500 .

• ASP.NET 500 , . MVC () , , HttpRequestValidationException MVC.

, , . , HttpRequestValidationException , , , 400.

:

4. 400 RFC 7231, -, , RFC 7231 2014 . HttpRequestValidationException 2003 , RFC 2616 RFC, 400 RFC 400 , HTTP . 400 , " - ", , .

, 500 , . , , .

, , , HttpRequestValidationException ( , , ), 400, 500.

Answer 2

MVC HttpRequestValidationException, , BadRequest:

protected void Application_Error()
{
    var lastError = Server.GetLastError();
    if (lastError is ArgumentException || lastError is HttpRequestValidationException)
    {
        Server.ClearError();
        Response.StatusCode = (int) HttpStatusCode.BadRequest;
    }
}