Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
OWASP Top 10: From 2017 to 2021, from Symptoms to Root Causes
We look at how the 2017 list was rebuilt in 2021: from Sensitive Data Exposure to Cryptographic Failures, Broken Access Control rising to number one, XSS joining Injection, and the arrival of Insecure Design and SSRF. A small .NET example shows that SQL parameters and HTML encoding answer the same root cause, and we walk through the 2021 methodology with its numbers.
OWASP A06: Insecure Design — Business Logic Flaws, Race Conditions and Rate Limiting
An order endpoint that works correctly line by line refunds money for a negative quantity, accepts a single-use coupon twice and sells the last copy to two people. We separate design flaws from implementation bugs, find the missing requirements with STRIDE and abuse cases, and fix them with a conditional UPDATE, a transaction, .NET 10 validation and rate limiting.