Danger: PipeReader JsonSerializer with context.Request.EnableBuffering

[brendonparker]

ReadFromJsonAsync uses PipeReader by default — breaks middleware request replay

The Problem

I have ASP.NET Core middleware that catches DbUpdateConcurrencyException and retries the request by calling next(context) again. To support re-reading the request body, I use the standard pattern:

context.Request.EnableBuffering();

while (tryCount++ < 3)
{
    try
    {
        await next(context);
        return;
    }
    catch (DbUpdateConcurrencyException ex)
    {
        await Task.Delay(tryCount * 250);
        context.Request.Body.Position = 0; // seek back to replay
    }
}

On retry, the downstream endpoint (FastEndpoints, but this applies to any code using ReadFromJsonAsync) fails with:

{
    "statusCode": 400,
    "message": "One or more errors occurred!",
    "errors": {
        "serializerErrors": [
            "The input does not contain any JSON tokens. Expected the input to start with a valid JSON token, when isFinalBlock is true. LineNumber: 0 | BytePositionInLine: 0."
        ]
    }
}

Root Cause

HttpRequest.ReadFromJsonAsync does not read from request.Body (the Stream) by default. It reads from request.BodyReader (a PipeReader):

// HttpRequestJsonExtensions.cs (ASP.NET Core source)
private static readonly bool _useStreamJsonOverload =
    AppContext.TryGetSwitch("Microsoft.AspNetCore.UseStreamBasedJsonParsing", out var isEnabled) && isEnabled;

// In ReadFromJsonAsync:
if (_useStreamJsonOverload)
{
    deserializeTask = JsonSerializer.DeserializeAsync<TValue>(request.Body, ...);
}
else
{
    deserializeTask = JsonSerializer.DeserializeAsync<TValue>(request.BodyReader, ...);
}

Since _useStreamJsonOverload defaults to false, deserialization goes through the PipeReader path. The PipeReader has its own internal buffer state that becomes "completed" after the first read. Resetting request.Body.Position = 0 has no effect because BodyReader never consults the underlying stream position.

EnableBuffering() correctly wraps the body in a seekable FileBufferingReadStream, but the PipeReader sitting on top of it doesn't know or care that the stream was seeked back.

Fix

A quick-get-unstuck is to set the Microsoft.AspNetCore.UseStreamBasedJsonParsing AppContext switch to force ReadFromJsonAsync to use the Stream-based path, which respects EnableBuffering() and stream position resets:

// Program.cs — before building the app
AppContext.SetSwitch("Microsoft.AspNetCore.UseStreamBasedJsonParsing", true);

But I need to research a better way to do the equivalent of context.Request.Body.Position = 0 but against the context.Request.BodyReader

Other gripes

This particular scenario (relying on EnableBuffering and fiddling with Request.Body) could be better called out in the release notes

Tagging @BrennanConroy for any possible thoughts/comments. Here is the PR that introduced this change: #62895

[BrennanConroy]

Looks the same as #64323, did you try 10.0.3?

[brendonparker]

That did it. Thank you!