James Newton-King

Thanks for filling the issue. I could reproduce it with your sample and I have a fix here: https://github.com/dotnet/aspnetcore/pull/57561

Deserializing in a web api means deserializing what JSON you’re given. Protection is needed in that direction to prevent JSON from impacting the availability of your app. Serializing outbound JSON...

> For example, if I have an application that gets an algebraic expression and return a json representation of the expression tree. In this case, the serialized object is controlled...

I removed `Range`. Creating a JArray for the result of the range isn't a good pattern. I left in `Index` and added some unit tests. Thanks for the PR.

Does this cause a problem?

FYI I have a PR adding metrics to identity here: https://github.com/dotnet/aspnetcore/pull/62078. Whoever merges second will need to react and add counters and tags for passkey signins.

gRPC always return 200 status code. Failure is communicated in grpc-status trailer. I haven't looked at how resilience works, but I'm guessing the retry happens inside a HTTP handler's SendAsync....

> Will buffering the content work? No. If an error happens before any content is returned by the server, then `grpc-status` is in the headers. That is the scenario that...

I don't think there is a way to avoid this. Perhaps looking at the internal exception type name (WinHttpHandler) and then parsing the exception message, but that is too easly...

PR with what I think is the fix you're looking for: https://github.com/grpc/grpc-dotnet/pull/2553 I modified one of thes test from https://github.com/grpc/grpc-dotnet/pull/2550 and included it.