Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
CORS and Security in ASP.NET Core Web API: HTTPS, HSTS, Headers and Secrets
We see with curl why CORS is not a firewall, define a policy and read the preflight request. HTTPS redirection, the localhost exception in HSTS, security headers and user secrets are covered too.
Authorization in ASP.NET Core Web API: Roles, Policies and Resource-Based Authorization
We start with [Authorize] and FallbackPolicy, then move to roles, policies, our own requirement and handler, and resource-based authorization. We see the RoleClaimType trap and 401 vs 403 with curl.
Authentication with JWT in ASP.NET Core Web API: Issuing and Validating Tokens
From the authentication vs authorization split to the anatomy of a JWT, we build a login flow with AddJwtBearer and JsonWebTokenHandler. ClockSkew, claim mapping and the refresh token idea are covered too.
File Upload and Download in ASP.NET Core Web API: IFormFile, Limits and Streaming
We upload product images with IFormFile and guard against path traversal and fake extensions. We cover Kestrel and form limits, downloads with PhysicalFile and streaming with MultipartReader.
Pagination, Filtering and Sorting in ASP.NET Core Web API: Returning Large Lists Safely
We gather query parameters in one class and run filtering, the total count, Skip/Take and allow-listed dynamic sorting in the database with IQueryable. Plus body vs header metadata, offset vs keyset, and the SQLite decimal trap.
Filters in ASP.NET Core Web API: Action Filters, Result Filters and ServiceFilter
We take apart MVC's filter pipeline with real logs: the order of global, controller and action filters, ServiceFilter for an async filter that uses DI, short-circuiting with TypeFilter, result filters, and middleware versus filters.
Global Error Handling in ASP.NET Core: Exception Middleware and ProblemDetails
Starting from the real response of an unhandled exception on .NET 6, we move to UseExceptionHandler with an error controller, then to our own middleware that maps domain exceptions to 404/409/500 ProblemDetails.
Async/Await and CancellationToken in ASP.NET Core: Carrying Cancellation All the Way to the Database
We watch threads return to the pool during await, measure how blocking code starves the thread pool, carry a CancellationToken from the action to EF Core, and cover the .Result and async void traps.
Layered Structure in ASP.NET Core Web API: The Service Layer and the Repository Debate
We slim down a fat controller and hand its work to IProductService. A reusable Expression projection, scoped registration, why a generic repository hurts on top of EF Core, and how interfaces help testing.
DTOs and Mapping in ASP.NET Core Web API: Hand Mapping, the AutoMapper License and Mapperly
We see the cost of returning entities directly through real errors: overposting and circular references. Request/response DTOs, hand mapping and projection, AutoMapper's 2025 license change and CVE, and a short look at Mapperly.
EF Core and SQLite in ASP.NET Core Web API: DbContext, the First Migration and CRUD
We add a data layer to an ASP.NET Core Web API with EF Core and SQLite: EF Core 6 and 10 package versions, AppDbContext, the connection string, why DbContext is scoped, the first migration, async CRUD and the SQL in the console.
Logging in ASP.NET Core: ILogger, Log Levels, Structured Logging and Serilog
We write logs with ILogger<T> in ASP.NET Core: categories, log levels, filters via appsettings and environment variables, structured logging with message templates, scopes, the LoggerMessage source generator and the Serilog version that supports net6.0.