Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
OWASP A05: Injection (1) — SQL Injection and Command Injection
We write the same book search endpoint with string concatenation, an ADO.NET parameter, Dapper and EF Core, and see how a parameter turns ' OR 1=1 -- into plain data. We examine FromSqlRaw vs FromSql through the EF1002 warning and ToQueryString, use ArgumentList and an allowlist instead of a shell in Process.Start, and clarify where input validation fits with .NET 10's built-in validation.
OWASP A04: Cryptographic Failures (2) — Password Storage, Data Protection and Secret Management
How exactly does ASP.NET Core Identity's PasswordHasher store a password? We decode the hash header to see PBKDF2-HMAC-SHA512 with 100,000 iterations, move to OWASP's 220,000 with SuccessRehashNeeded, build a signed, time-limited share link with the Data Protection API, and keep secrets out of the code with user-secrets and environment variables.
OWASP A04: Cryptographic Failures (1) — Encoding, Hashing, Encryption and HTTPS
Why Base64 is not encryption and how hashing differs from encryption. We catch tampered data with AES-GCM, use RandomNumberGenerator instead of Random for password reset codes, see why MD5 is wrong for passwords, turn on the CA5351 and CA5394 analyzers, and inspect HTTPS redirection and HSTS defaults in ASP.NET Core with curl.
OWASP A03: Software Supply Chain Failures — NuGetAudit, npm audit and SRI
Why is A03:2025 Software Supply Chain Failures its own category? Lessons from event-stream, Log4Shell, xz, polyfill.io and the 2025 npm incidents; NuGetAudit scanning transitive dependencies on net10.0, warnings that break the build, lock files, npm audit and npm ci, SRI for CDN scripts, an SBOM with CycloneDX, provenance and Dependabot.
OWASP A02: Security Misconfiguration — Error Pages, OpenAPI, Headers and XXE
Same code, wrong settings: a developer exception page enabled unconditionally in Production dumps a stack trace, and a forgotten MapOpenApi line hands the whole API map to a customer. We fix it with ProblemDetails, per-environment configuration, AllowedHosts, a disabled Server header, a small middleware for CSP and nosniff and a look at why HSTS doesn't show up on localhost, then build a hardened XmlReader that rejects an XML document containing a DTD.
OWASP A01: Broken Access Control (2) — Path Traversal, CORS and SSRF
A download endpoint that takes a file name from the client, a CORS policy that echoes back every origin and cover-download code that requests whatever URL it is given. We examine the three vulnerable patterns and close them with a canonical path check, a policy that lists origins one by one and an HttpClient with an allowlist, disabled redirects and an IP check in ConnectCallback, then watch the fixed code reject bad input in the lab.
OWASP A01: Broken Access Control (1) — IDOR, Admin Endpoints and Authorization in ASP.NET Core
Logged in as Alan, we read Grace's order by changing the order number and pull every user from an admin endpoint whose role check was forgotten. We show both flaws in the lab and close them with policies, resource-based authorization through IAuthorizationService and a deny-by-default fallback policy, and discuss choosing between 403 and 404 and the .NET 10 change to cookie redirects.
The Security Lab: A Bookstore API with ASP.NET Core 10 and Reading HTTP with curl
We set up the lab for the rest of the series: an ASP.NET Core 10 minimal API on SQLite. With curl -i we read methods, status codes, headers and cookies through a security lens, see how the same error reaches the client differently in Development and Production, and cover the HTTPS development certificate and the lab rules.
An Introduction to Web Security: What Is the OWASP Top 10:2025 and How to Read It
Why security can't be a feature added later. We start with a small endpoint that returns another customer's order, then cover the CIA triad and the attack surface, what OWASP is, why the Top 10 is an awareness document rather than a standard, how the list is built from data and a survey, and the ten categories of the 2025 list.