[AuditApi] - override middleware settings with controller attributes about audit.net

[thepirat000]

The problem is that the configuration is independent between the AuditApiAttribute (filter) and the AuditMiddleware.

You're configuring the AuditApi filter not to log the response for that action, but the middleware will still log it since it has the IncludeResponseBody with no restrictions (UseAuditMiddleware(_ => _.IncludeResponseBody()))

On the other hand, the AuditIgnoreAttribute is globally used by both, the filter and the middleware.

I think you still have more options, one is including the logic to determine whether the response body should be logged by the audit middleware:

applicationBuilder.UseAuditMiddleware(config => config
	.IncludeResponseBody(ctx => !ctx.Request.Path.Value.Contains("/sample/action"))
	//...
);

Or you can even try to get the action filter in the middleware configuration and use its value:

applicationBuilder.UseAuditMiddleware(config => config
    .IncludeResponseBody(ctx =>
    {
        var auditApiAttribute = ctx.GetEndpoint()?.Metadata.GetMetadata<ControllerActionDescriptor>()?
            .FilterDescriptors
            .Select(f => f.Filter)
            .OfType<AuditApiAttribute>()
            .FirstOrDefault();
        return auditApiAttribute?.IncludeResponseBody ?? true;
    })

Another option could be to exclude the response body from the audit event after it's created, but before it's saved with a custom action, for example:

Audit.Core.Configuration.AddOnSavingAction(scope =>
{
    var apiAction = scope.GetWebApiAuditAction();
    if (apiAction?.ActionName == "SampleAction")
    {
        apiAction.ResponseBody.Value = null;
    }
});

[SerhiyBalan]

@thepirat000 thank you very much for the tips!

Solutions 1 and 3 are not ideal for big projects. It is hard to maintain them if I use controller/action names as strings for filtering.

Solution 2 is a good one (with GetEndpoint).
It improves project maintainability a lot.
However, I decided to introduce two new attributes in my project: AuditIgnoreRequestBodyAttributeand AuditIgnoreResponseBodyAttribute.
For me, it is much easier to work with rather than working with the master attribute like [AuditApi(IncludeResponseBody = true)]

You can close this issue if you want

[SerhiyBalan]

I managed to find an another workaround

and it is kinda weird

[AuditApi]
public class SampleController : BaseController 
{
    [HttpGet]
    [AllowAnonymous]
    [return:AuditIgnore]
    [AuditApi(IncludeResponseBody = true)]
    public Task<SomeModel> ([FromBody] SomeOtherModel model)
    {
        ...
    }
}

so for some strange reason this combination works

    [return:AuditIgnore]
    [AuditApi(IncludeResponseBody = true)]

and this one doesn't work

    [return:AuditIgnore]
    [AuditApi(IncludeResponseBody = false)]

this one doesn't work too

    [return:AuditIgnore] // single attribute, without [AuditApi]