Blog

Mert Özen's blog posts on software development, backend, frontend, and DevOps.

Series

Authorization in ASP.NET Core Web API: Roles, Policies and Resource-Based Authorization

We start with [Authorize] and FallbackPolicy, then move to roles, policies, our own requirement and handler, and resource-based authorization. We see the RoleClaimType trap and 401 vs 403 with curl.

4 Nov 2026 8 min 2

Backend PART 22

Authentication with JWT in ASP.NET Core Web API: Issuing and Validating Tokens

From the authentication vs authorization split to the anatomy of a JWT, we build a login flow with AddJwtBearer and JsonWebTokenHandler. ClockSkew, claim mapping and the refresh token idea are covered too.

4 Nov 2026 10 min 2