Does not work with AspNetCore.MVC 1.1.1

[xperiandri]

Application startup exception: System.IO.FileLoadException: Could not load file or assembly 'Microsoft.AspNetCore.Mvc.Core, Version=1.1.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60' or one of its dependencies. The located assembly's manifest definition does not match the assembly reference. (Exception from HRESULT: 0x80131040)
File name: 'Microsoft.AspNetCore.Mvc.Core, Version=1.1.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60' ---> System.IO.FileLoadException: Could not load file or assembly 'Microsoft.AspNetCore.Mvc.Core, Version=1.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60' or one of its dependencies. The located assembly's manifest definition does not match the assembly reference. (Exception from HRESULT: 0x80131040)
File name: 'Microsoft.AspNetCore.Mvc.Core, Version=1.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60'

WRN: Assembly binding logging is turned OFF.
To enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1.
Note: There is some performance penalty associated with assembly bind failure logging.
To turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog].

   at Microsoft.Extensions.DependencyInjection.IServiceCollectionExtensions.AddApiVersioning(IServiceCollection services, Action`1 setupAction)
   at HahaTaxi.Api.Startup.ConfigureServices(IServiceCollection services) in C:\Users\??????\Dev\XperiAndri\HAHA Taxi\src\HahaTaxi.Api\Startup.cs:line 73
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at Microsoft.AspNetCore.Hosting.ConventionBasedStartup.ConfigureServices(IServiceCollection services)
   at Microsoft.AspNetCore.Hosting.Internal.WebHost.EnsureApplicationServices()
   at Microsoft.AspNetCore.Hosting.Internal.WebHost.BuildApplication()


Hosting environment: Stagging
Application started. Press Ctrl+C to shut down.
Application is shutting down...

[RehanSaeed]

+1 for ASP.NET Core 1.10 support (and 1.1.1 if required).

[commonsensesoftware]

I have some other immediate changes that need to go out this week too. I'll re-hash this. This looks like a simple assembly binding redirection misconfiguration.

Which toolset are you using - Visual Studio 2015 or 2017? I want to make sure I can reproduce your setup and configuration.

[xperiandri]

2015
When MVC 1.1.0 used, no issues

[commonsensesoftware]

To be clear (since you are both reporting it):

• 1.0.0 - works (obviously)
• 1.1.0 - works
• 1.1.1 - doesn't work

Don't get me wrong, I believe you. It seems very bizarre that a revision/patch version would cause this kind of failure. It would seem the ASP.NET team may have introduced a breaking change in package itself.

A somewhat similar change was asked for in #66. I'm wondering if there is an ASP.NET Core package change and these two issues are related. I'll let you know what I find.

[commonsensesoftware]

I've done some more investigation into this issue. I'm not really sure the cause. I'll be updating the references to 1.1.0 and Microsoft.AspNetCore.Mvc.Core. The full MVC package isn't needed as mentioned in #66. The only thing that kind of leaped out as a possible culprit was the Microsoft.AspNetMvc.Mvc 1.1.0 updated it's references to NETStandard.Library 1.6.1 (from 1.6.0).

Is 1.1.1 specifically needed or is 1.1.0 sufficient? I want to avoid publishing multiple packages until I have to. I also want to target the lowest supported version (e.g. 1.1.0) and let developers choose when they want to update to newer versions (e.g. 1.1.1). This is important for other library and tool authors as well.

[xperiandri]

We just released an update for ASP.NET Core 1.1 due to Microsoft Security Advisory 4010983. The advisory is for a vulnerability in ASP.NET Core MVC 1.1.0 that could allow denial of service. All of the information you need is in the advisory. A short summary is provided below.

https://blogs.msdn.microsoft.com/dotnet/2017/01/30/january-2017-update-for-asp-net-core-1-1/

Microsoft is aware of a security vulnerability in the public version of ASP.NET Core MVC 1.1.0 where a malformed HTTP request could lead to a denial of service.
Developers are advised to update all apps to use package version 1.1.1 or greater.

So you don't need to support Microsoft.AspNetCore.Mvc.Core 1.1.0 as it is not safe.

[commonsensesoftware]

Perfect! These are the details I was looking for. Thanks. Updating to 1.1.1 only.