Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
OWASP Top 10:2017: XXE, Insecure Deserialization and the Lessons That Remain
We look at the OWASP Top 10:2017 list, the web it was written for and what changed from 2013 to 2017. We see with a real request how .NET 10 rejects XXE by default, show in code why BinaryFormatter no longer compiles or runs, and compare the years when XSS had its own category with today's list.
OWASP A02: Security Misconfiguration — Error Pages, OpenAPI, Headers and XXE
Same code, wrong settings: a developer exception page enabled unconditionally in Production dumps a stack trace, and a forgotten MapOpenApi line hands the whole API map to a customer. We fix it with ProblemDetails, per-environment configuration, AllowedHosts, a disabled Server header, a small middleware for CSP and nosniff and a look at why HSTS doesn't show up on localhost, then build a hardened XmlReader that rejects an XML document containing a DTD.