MediatR管道中FluentValidation返回含堆栈跟踪的错误原因排查

现有基于MediatR+FluentValidation的管道验证实现，触发ValidationException时，API响应除了验证消息外还返回完整堆栈跟踪，而正常错误返回标准格式。相关代码如下：

现有实现代码 #

ValidationBehavior 管道行为 #

public class ValidationBehavior<TRequest, TResponse> : IPipelineBehavior<TRequest, TResponse>
    where TRequest : IRequest<TResponse>
{
    private readonly IEnumerable<IValidator<TRequest>> _validators;

    public ValidationBehavior(IEnumerable<IValidator<TRequest>> validators)
    {
        _validators = validators;
    }

    public async Task<TResponse> Handle(
        TRequest request,
        RequestHandlerDelegate<TResponse> next,
        CancellationToken cancellationToken)

    {
        var context = new ValidationContext<TRequest>(request);

        var failures = _validators
            .ToAsyncEnumerable()
            .SelectAwait(async validator => await validator.ValidateAsync(context))
            .ToEnumerable()
            .SelectMany(result => result.Errors)
            .Where(failure => failure is not null)
            .ToList();

        if (failures.Any())
        {
            throw new ValidationException(failures);
        }

        return await next();
    }
}

MediatR 注册代码 #

services.AddMediatR(options =>
{
    options.RegisterServicesFromAssembly(typeof(ServiceCollectionExtension).Assembly);
    options.AddOpenBehavior(typeof(ValidationBehavior<,>));
});

验证器代码 #

internal class DepositCommandHandlerValidator : AbstractValidator<DepositCommand>
{
    public DepositCommandHandlerValidator()
    {
        RuleFor(c => c.Amount).GreaterThan(0).WithMessage("Amount must be greater than 0.");
    }
}

控制器接口代码 #

[HttpPatch("deposit")]
public async Task<IActionResult> Deposit([FromRoute] Guid id, [FromBody] decimal amount)
{
    bool result = await _mediator.Send(new DepositCommand(id, amount), CancellationToken.None);
    if (result)
    {
        return NoContent();
    }
    return BadRequest();
}

1. 异常未被自定义处理，冒泡到框架默认中间件：ValidationBehavior抛出的ValidationException没有在控制器或全局层面被捕获处理，直接被ASP.NET Core默认的异常处理中间件（如DeveloperExceptionPageMiddleware）捕获。在开发环境下，该中间件会默认返回包含堆栈跟踪的详细错误信息；即使在生产环境，若未配置自定义异常处理，也会返回非标准化的错误响应。
2. 缺少全局统一异常处理机制：没有针对ValidationException的专属处理逻辑，无法将其转换为仅包含验证消息的标准BadRequest响应。

方案1：控制器内直接捕获异常 #

修改控制器方法，手动捕获ValidationException并返回标准化响应：

[HttpPatch("deposit")]
public async Task<IActionResult> Deposit([FromRoute] Guid id, [FromBody] decimal amount)
{
    try
    {
        bool result = await _mediator.Send(new DepositCommand(id, amount), CancellationToken.None);
        return result ? NoContent() : BadRequest();
    }
    catch (ValidationException ex)
    {
        var errors = ex.Errors.Select(e => new { Field = e.PropertyName, Message = e.ErrorMessage });
        return BadRequest(new { Errors = errors });
    }
}

方案2：全局异常处理中间件（推荐） #

创建全局中间件统一处理所有异常，确保响应格式一致：

1. 定义中间件：

public class GlobalExceptionMiddleware
{
    private readonly RequestDelegate _next;
    private readonly ILogger<GlobalExceptionMiddleware> _logger;

    public GlobalExceptionMiddleware(RequestDelegate next, ILogger<GlobalExceptionMiddleware> logger)
    {
        _next = next;
        _logger = logger;
    }

    public async Task InvokeAsync(HttpContext context)
    {
        try
        {
            await _next(context);
        }
        catch (ValidationException ex)
        {
            _logger.LogError(ex, "Validation failed");
            context.Response.StatusCode = StatusCodes.Status400BadRequest;
            context.Response.ContentType = "application/json";
            
            var errors = ex.Errors.Select(e => new 
            { 
                Property = e.PropertyName, 
                Message = e.ErrorMessage 
            });
            
            await context.Response.WriteAsJsonAsync(new 
            { 
                StatusCode = 400, 
                Message = "Validation error", 
                Errors = errors 
            });
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Unhandled exception");
            context.Response.StatusCode = StatusCodes.Status500InternalServerError;
            context.Response.ContentType = "application/json";
            
            var response = new 
            { 
                StatusCode = 500, 
                Message = Environment.IsDevelopment() ? ex.Message : "An unexpected error occurred" 
            };
            
            await context.Response.WriteAsJsonAsync(response);
        }
    }
}

2. 在Program.cs中注册中间件（需放在app.UseRouting()之后、app.UseEndpoints()之前）：

app.UseMiddleware<GlobalExceptionMiddleware>();

方案3：利用FluentValidation.AspNetCore自动集成 #

若已引用FluentValidation.AspNetCore包，可直接使用其内置的异常处理：
在Program.cs中添加服务注册：

services.AddFluentValidationAutoValidation()
        .AddFluentValidationClientsideAdapters();

该配置会自动将ValidationException转换为标准400响应，仅返回验证错误消息，不会包含堆栈跟踪。

内容的提问来源于stack exchange，提问作者defcon1