title: WebApi + OData: limit maximum results
body: <p>I have a WebAPI controller that takes an <code>ODataOptions</code> parameter.</p>
  
  <p>I want to make sure the user can't download the whole database in one swoop.<br>
  So I validated the <code>options</code> object:</p>
  
  <pre><code>public IHttpActionResult Get(ODataQueryOptions&lt;ViewModel&gt; options)
  { 
  
      var oDataValidationSettings = new ODataValidationSettings
      {
          MaxTop = 100
      }
      try 
      {
          options.Validate(oDataValidationSettings);
      } 
      catch (ODataException ex)
      {
          return BadRequest("OData query validation failed: " + ex.Message);
      }
      //return results
  }
  </code></pre>
  
  <p>This works great for calls like </p>
  
  <pre><code>http://host/api/controller?$filter=...&amp;$top=1000
  </code></pre>
  
  <p>This returns the expected validation error message.</p>
  
  <p>But it is trivially easy to circumvent by simply making a request to:</p>
  
  <pre><code>http://host/api/controller?
  </code></pre>
  
  <p>No <code>$top</code>, no nothing. <strong>This in effect returns the whole table!</strong><br>
  The validator is not triggered if the <code>$top</code> parameter is not specified at all.</p>
  
  <p>I could append a <code>.Take(100)</code> when constructing the query from the oData options, but it seems hacky. </p>
  
  <p>Is there any better way to deal with a missing <code>$top</code>?</p>