FluentValidation — Setup and Basic Rules

FluentValidation is a library for building strongly-typed validation rules in C# using a fluent API. It is more expressive than DataAnnotations for complex validation: you can read the rules as plain English, conditional rules are straightforward, async validators are first-class, and error messages are easy to customise with dynamic placeholders. It integrates with ASP.NET Core’s [ApiController] to produce the same ValidationProblemDetails response format — the Angular client sees no difference.

FluentValidation Setup #

// dotnet add package FluentValidation.AspNetCore

// ── Program.cs — register FluentValidation ────────────────────────────────
builder.Services
    .AddControllers()
    .AddFluentValidationAutoValidation()   // replaces [ApiController] manual validation
    .AddFluentValidationClientsideAdapters();  // optional: generate client-side rules

// Register all validators from the assembly
builder.Services.AddValidatorsFromAssemblyContaining<CreatePostRequestValidator>();

// ── Validator class ────────────────────────────────────────────────────────
public class CreatePostRequestValidator : AbstractValidator<CreatePostRequest>
{
    public CreatePostRequestValidator()
    {
        RuleFor(x => x.Title)
            .NotEmpty().WithMessage("Title is required.")
            .MinimumLength(5).WithMessage("Title must be at least 5 characters.")
            .MaximumLength(200).WithMessage("Title must not exceed 200 characters.");

        RuleFor(x => x.Body)
            .NotEmpty().WithMessage("Body content is required.")
            .MinimumLength(50).WithMessage("Body must be at least 50 characters.");

        RuleFor(x => x.Slug)
            .NotEmpty().WithMessage("Slug is required.")
            .MaximumLength(100)
            .Matches(@"^[a-z0-9-]+$")
            .WithMessage("Slug must contain only lowercase letters, numbers, and hyphens.");

        RuleFor(x => x.Tags)
            .Must(t => t.Count <= 10)
            .WithMessage("A post can have at most 10 tags.");

        // Must() — simple custom predicate
        RuleFor(x => x.Excerpt)
            .MaximumLength(250)
            .Must(e => e is null || !e.Contains("<script"))
            .WithMessage("Excerpt contains invalid content.");
    }
}

// ── Readable validation rules summary ─────────────────────────────────────
// "Title is required, 5–200 characters."
// "Body is required, at least 50 characters."
// "Slug is required, lowercase alphanumeric with hyphens, max 100 chars."
// "Tags: max 10 allowed."
// "Excerpt: max 250 chars, no script tags."

FluentValidation vs DataAnnotations #

Common Mistakes #

Mistake 1 — DataAnnotations silently disabled after AddFluentValidationAutoValidation() #

❌ Wrong — [Required] stops running; invalid requests now reach action bodies.

✅ Correct — migrate DataAnnotations to FluentValidation rules, or verify both are running with a test.

Mistake 2 — Not registering the validator (no validation runs, action always succeeds) #

❌ Wrong — new validator class added but not registered; requests bypass validation silently.

✅ Correct — use AddValidatorsFromAssemblyContaining<T>() to auto-register all validators.