title: asp.net core webapi route constraint regex seems to be ignored in certain circumstances
body: <p>This application is built on ASP.Net Core (.NET Core 2.1). I'm trying to configure a controller (see <code>RiskController</code> below) to support the following via http get:</p>
  
  <ol>
  <li>Get by ID (<code>/api/risk/0000001</code>) should return a single risk graph</li>
  <li>Find by name (<code>/api/risk/some%20company%20name</code>) should return an array of search results</li>
  <li>Validate ID (<code>/api/risk/0000002/validate</code>) should return a true/false if the id exists</li>
  </ol>
  
  <p>Pretty simple stuff, and this all works when the parameter values are ideally suited to each action. I am using regex to constrain the actions and that helps a lot.</p>
  
  <p>My controller declaration:</p>
  
  <pre class="lang-cs prettyprint-override"><code>    [Produces( "application/json" )]
      [Route( "api/[controller]" )]
      [Authorize]
      [ApiController]
      public class RiskController : ControllerBase
  </code></pre>
  
  <p>The get by ID action:</p>
  
  <pre class="lang-cs prettyprint-override"><code>        // GET api/risk/0000001
          [HttpGet( "{riskId:regex(^\\d{{7}}|(SI[[PG]]|JPA|DEM)\\d{{4}})}", Order = 0 )]
          public async Task&lt;IActionResult&gt; Get( string riskId ) { ... }
  </code></pre>
  
  <p>The find by name action:</p>
  
  <pre class="lang-cs prettyprint-override"><code>        // GET api/risk/some%20company%20name
          [HttpGet( "{name:length(2,30)}", Order = 1 )]
          public async Task&lt;IActionResult&gt; Search( string name ) { ... }
  </code></pre>
  
  <p>The validate ID action:</p>
  
  <pre class="lang-cs prettyprint-override"><code>        // GET api/risk/0000001/validate
          [HttpGet( "{riskId:regex(^\\d{{7}}|(SI[[PG]]|JPA|DEM)\\d{{4}})}/[action]", Order = 2 )]
          public async Task&lt;IActionResult&gt; Validate( string riskId )
  </code></pre>
  
  <p>IDs are always 7 digit strings, or begin with SIP, SIG, JPA or DEM followed by 4 digits (one of e.g.: "0000002", "SIP0003", "SIG0004", "JPA0005" OR "DEM0006").</p>
  
  <p>Now to the case that has me baffled is when a user enters, say a <strong>nine</strong> digit number into the search by name field. The search by name should call the api with <code>/api/risk/000000019</code>. And that should be handled by the above <em>find by name action</em>. But, the constraint regex on the above <em>get by ID action</em> matches the nine digit number for some reason which of course doesn't find a entry. And the user sees an error.
  However if the user enters, say a <strong>four</strong> digit number in the the search by name field, the call to <code>/api/risk/0004</code> matches to the above <em>search by name action</em> and works as it should. </p>
  
  <p>Shouldn't the <code>\d{7}</code> part of the constraint on the <em>get by ID action</em> regex match exactly 7 digits and no more? <code>/api/risk/000000019</code> certainly doesn't match the second half of the regex: <code>(SI[PG]|JPA|DEM)\d{4}</code>!</p>
  
  <p>Any advice?</p>