Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
CORS, Rate Limiting and Security Headers: Hardening the API Against External Threats
We cover three topics that harden the API against misuse: controlling which sites can access it with CORS, limiting requests with rate limiting, and adding basic protection with security headers.
Role- and Policy-Based Authorization: Deciding Who Is Allowed to Do What
We deepen authorization: what role-based permission is, where it falls short, how the policy and claim-based approach offers a more flexible solution, and how we set these up in .NET.
Authentication with JWT: How a Token Is Created and Verified
We cover authentication with JWT: what a token is, what its three parts mean, why it's signed, why the server is stateless, and setting up token creation and verification in .NET step by step.
Authentication and Authorization: The Difference Between Identity Verification and Permission
We separate two concepts most developers confuse: authentication (who are you?) and authorization (what are you allowed to do?). The difference, the correct order, and how these are positioned in .NET.