Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
OWASP Beyond the Top 10: API Security, LLM Top 10, ASVS and the Cheat Sheet Series
We step outside the Top 10: the API Security Top 10 (2023) and the split between BOLA, BOPLA and BFLA, preventing property-level data exposure with a response DTO, the Top 10 for LLM Applications (2025), ASVS 5.0 and the Cheat Sheet Series. We also talk about how the series continues with new Top 10 editions and which security series come next.
OWASP Top 10: What Changed from 2021 to 2025 and Updating Old Documents
SSRF joining A01, the components problem growing into Software Supply Chain Failures, Security Misconfiguration rising to second place, the new A10 Mishandling of Exceptional Conditions and three renames. We read the 2025 methodology with its numbers and write a small .NET tool that finds old and year-less category numbers and suggests their 2025 counterparts.
OWASP Top 10: From 2017 to 2021, from Symptoms to Root Causes
We look at how the 2017 list was rebuilt in 2021: from Sensitive Data Exposure to Cryptographic Failures, Broken Access Control rising to number one, XSS joining Injection, and the arrival of Insecure Design and SSRF. A small .NET example shows that SQL parameters and HTML encoding answer the same root cause, and we walk through the 2021 methodology with its numbers.
OWASP Top 10:2017: XXE, Insecure Deserialization and the Lessons That Remain
We look at the OWASP Top 10:2017 list, the web it was written for and what changed from 2013 to 2017. We see with a real request how .NET 10 rejects XXE by default, show in code why BinaryFormatter no longer compiles or runs, and compare the years when XSS had its own category with today's list.
Putting the OWASP Top 10 Together: Secure Defaults for ASP.NET Core and Angular
We put the ten categories together in a single Program.cs: fallback policy, cookie flags, ProblemDetails, rate limiting that returns 429, security headers and rejecting unknown JSON fields. We verify everything with curl, do SAST with the .NET analyzers, write security regression tests with WebApplicationFactory, and talk about DAST and moving to ASVS 5.0.
OWASP A10: Mishandling of Exceptional Conditions — Fail Closed and ProblemDetails
We start with a permission check that makes everyone an admin when the permission file cannot be read, a review endpoint that sends the SQL error and file path to the client, and a search that keeps running after the client has left. We fix them with fail closed, catching errors where they occur, IExceptionHandler and ProblemDetails, the .NET 10 handler logging change, request timeouts and cancellation.
OWASP A09: Security Logging and Alerting Failures — What to Log, What Never to Log
We start with a login endpoint that writes wrong passwords to the log, lets a line break forge a record and never records 403s. We move to structured logging with LoggerMessage and the JSON console, make authorization denials visible, protect the email with HMAC redaction, tie the response to the log through traceId and look at which events deserve an alert.
OWASP A08: Software or Data Integrity Failures — Deserialization and Mass Assignment
We explain conceptually why letting incoming data choose its own type is dangerous, and show with real output how BinaryFormatter ends on net10.0 with a build error and a PlatformNotSupportedException. We set up allow-list polymorphism in System.Text.Json, close mass assignment with DTOs and JsonUnmappedMemberHandling, and look at code integrity through CI/CD and SRI.
OWASP A07: Authentication Failures (2) — Cookie Flags, JWT Validation and CSRF
We look at how identity is carried on every request after login. We set cookie flags and the __Host- prefix explicitly, explain the session fixation risk, validate issuer, audience, lifetime, signature and algorithm in JwtBearer, measure the effect of ClockSkew on an expired token second by second, and show how antiforgery and SameSite work together against CSRF.
OWASP A07: Authentication Failures (1) — Brute Force, Lockout and NIST Password Rules
We start with a login endpoint that accepts unlimited attempts and reveals whether a user exists through its message and its response time. We separate brute force from credential stuffing, compare Identity's default password rules with NIST SP 800-63B-4, fix it with a blocklist validator, lockout and a uniform response, and take a short look at MFA and passkeys.
OWASP A06: Insecure Design — Business Logic Flaws, Race Conditions and Rate Limiting
An order endpoint that works correctly line by line refunds money for a negative quantity, accepts a single-use coupon twice and sells the last copy to two people. We separate design flaws from implementation bugs, find the missing requirements with STRIDE and abuse cases, and fix them with a conditional UPDATE, a transaction, .NET 10 validation and rate limiting.
OWASP A05: Injection (2) — XSS, Razor Encoding, innerHTML, CSP and Trusted Types
We examine reflected, stored and DOM-based XSS in the Bookstore lab: HtmlEncoder and Razor's automatic encoding, the trap of writing a value from a JSON API with innerHTML and the textContent fix, Angular's sanitization and the bypassSecurityTrust* risk, then how CSP and Trusted Types stop unsafe code in headless Chrome as a second line of defense.