HighFile-scopeC# Plug & play

Do Not Start Route Templates with '/' in ASP.NET

Starting a route template with '/' in ASP.NET makes it absolute, ignoring controller-level routes and potentially breaking expected routing behavior.

Add to Mesrai Open workspace

Why this matters

Starting a route template with '/' in ASP.NET makes it absolute, ignoring controller-level routes and potentially breaking expected routing behavior.

Bad vs. good

Side-by-side examples engineers can pattern-match during review.

Avoid

[Route("[controller]")]  // This route is ignored
public class ReviewsController : Controller // Noncompliant
{
    // Route is /reviews
    [HttpGet("/reviews")]
    public ActionResult Index() { /* ... */ }

    // Route is /reviews/{reviewId}
    [Route("/reviews/{reviewId}")]
    public ActionResult Show(int reviewId)() { /* ... */ }
}

Prefer

[Route("/")] // Turns on attribute routing
public class ReviewsController : Controller
{
    // Route is /reviews
    [HttpGet("reviews")]
    public ActionResult Index() { /* ... */ }

    // Route is /reviews/{reviewId}
    [Route("reviews/{reviewId}")]
    public ActionResult Show(int reviewId)() { /* ... */ }
}

More snippets

Bad

[Route("[controller]")]  // This route is ignored
public class ReviewsController : Controller // Noncompliant
{
    // Route is /reviews
    [HttpGet("/reviews")]
    public ActionResult Index() { /* ... */ }

    // Route is /reviews/{reviewId}
    [Route("/reviews/{reviewId}")]
    public ActionResult Show(int reviewId)() { /* ... */ }
}

Good

[Route("/")] // Turns on attribute routing
public class ReviewsController : Controller
{
    // Route is /reviews
    [HttpGet("reviews")]
    public ActionResult Index() { /* ... */ }

    // Route is /reviews/{reviewId}
    [Route("reviews/{reviewId}")]
    public ActionResult Show(int reviewId)() { /* ... */ }
}

Related rules

From the same buckets as this rule.

Critical
Check consent and role-based authorization before returning ePHI
Handlers must verify the requester’s role and a valid consent/relationship (e.g., care team assignment) before disclosing ePHI; include Purpose-Of-Use in the decision and audit the outcome.
compliance-hipaasecurity-hardening+2
Critical
Children's data: verify age and parental consent
If data subject is a child/adolescent, require age verification and parental/legal guardian consent prior to processing; deny processing otherwise and do not store the payload.
compliance-lgpdapi-conventions+1
Critical
Disallow public ingress without explicit allowlist
For Ingress/Service of type LoadBalancer, require host/path allowlist and TLS; forbid 0.0.0.0/0 exposure without WAF or Auth.
infra-as-codesecurity-hardening+1

Bad vs. good

Side-by-side examples engineers can pattern-match during review.

Avoid

[Route("[controller]")]  // This route is ignored
public class ReviewsController : Controller // Noncompliant
{
    // Route is /reviews
    [HttpGet("/reviews")]
    public ActionResult Index() { /* ... */ }

    // Route is /reviews/{reviewId}
    [Route("/reviews/{reviewId}")]
    public ActionResult Show(int reviewId)() { /* ... */ }
}

Prefer

[Route("/")] // Turns on attribute routing
public class ReviewsController : Controller
{
    // Route is /reviews
    [HttpGet("reviews")]
    public ActionResult Index() { /* ... */ }

    // Route is /reviews/{reviewId}
    [Route("reviews/{reviewId}")]
    public ActionResult Show(int reviewId)() { /* ... */ }
}

More snippets

Bad

[Route("[controller]")]  // This route is ignored
public class ReviewsController : Controller // Noncompliant
{
    // Route is /reviews
    [HttpGet("/reviews")]
    public ActionResult Index() { /* ... */ }

    // Route is /reviews/{reviewId}
    [Route("/reviews/{reviewId}")]
    public ActionResult Show(int reviewId)() { /* ... */ }
}

Good

[Route("/")] // Turns on attribute routing
public class ReviewsController : Controller
{
    // Route is /reviews
    [HttpGet("reviews")]
    public ActionResult Index() { /* ... */ }

    // Route is /reviews/{reviewId}
    [Route("reviews/{reviewId}")]
    public ActionResult Show(int reviewId)() { /* ... */ }
}

Related rules

From the same buckets as this rule.

Critical

Check consent and role-based authorization before returning ePHI

Handlers must verify the requester’s role and a valid consent/relationship (e.g., care team assignment) before disclosing ePHI; include Purpose-Of-Use in the decision and audit the outcome.

compliance-hipaasecurity-hardening+2

Critical

Children's data: verify age and parental consent

If data subject is a child/adolescent, require age verification and parental/legal guardian consent prior to processing; deny processing otherwise and do not store the payload.

compliance-lgpdapi-conventions+1

Critical

Disallow public ingress without explicit allowlist

For Ingress/Service of type LoadBalancer, require host/path allowlist and TLS; forbid 0.0.0.0/0 exposure without WAF or Auth.

infra-as-codesecurity-hardening+1