Blog

OWASP A02: Security Misconfiguration — Error Pages, OpenAPI, Headers and XXE

Same code, wrong settings: a developer exception page enabled unconditionally in Production dumps a stack trace, and a forgotten MapOpenApi line hands the whole API map to a customer. We fix it with ProblemDetails, per-environment configuration, AllowedHosts, a disabled Server header, a small middleware for CSP and nosniff and a look at why HSTS doesn't show up on localhost, then build a hardened XmlReader that rejects an XML document containing a DTD.