Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
An Introduction to Web Security: What Is the OWASP Top 10:2025 and How to Read It
Why security can't be a feature added later. We start with a small endpoint that returns another customer's order, then cover the CIA triad and the attack surface, what OWASP is, why the Top 10 is an awareness document rather than a standard, how the list is built from data and a survey, and the ten categories of the 2025 list.
The Security Lab: A Bookstore API with ASP.NET Core 10 and Reading HTTP with curl
We set up the lab for the rest of the series: an ASP.NET Core 10 minimal API on SQLite. With curl -i we read methods, status codes, headers and cookies through a security lens, see how the same error reaches the client differently in Development and Production, and cover the HTTPS development certificate and the lab rules.
OWASP A01: Broken Access Control (1) — IDOR, Admin Endpoints and Authorization in ASP.NET Core
Logged in as Alan, we read Grace's order by changing the order number and pull every user from an admin endpoint whose role check was forgotten. We show both flaws in the lab and close them with policies, resource-based authorization through IAuthorizationService and a deny-by-default fallback policy, and discuss choosing between 403 and 404 and the .NET 10 change to cookie redirects.
OWASP A01: Broken Access Control (2) — Path Traversal, CORS and SSRF
A download endpoint that takes a file name from the client, a CORS policy that echoes back every origin and cover-download code that requests whatever URL it is given. We examine the three vulnerable patterns and close them with a canonical path check, a policy that lists origins one by one and an HttpClient with an allowlist, disabled redirects and an IP check in ConnectCallback, then watch the fixed code reject bad input in the lab.
OWASP A02: Security Misconfiguration — Error Pages, OpenAPI, Headers and XXE
Same code, wrong settings: a developer exception page enabled unconditionally in Production dumps a stack trace, and a forgotten MapOpenApi line hands the whole API map to a customer. We fix it with ProblemDetails, per-environment configuration, AllowedHosts, a disabled Server header, a small middleware for CSP and nosniff and a look at why HSTS doesn't show up on localhost, then build a hardened XmlReader that rejects an XML document containing a DTD.
OWASP A03: Software Supply Chain Failures — NuGetAudit, npm audit and SRI
Why is A03:2025 Software Supply Chain Failures its own category? Lessons from event-stream, Log4Shell, xz, polyfill.io and the 2025 npm incidents; NuGetAudit scanning transitive dependencies on net10.0, warnings that break the build, lock files, npm audit and npm ci, SRI for CDN scripts, an SBOM with CycloneDX, provenance and Dependabot.
OWASP A04: Cryptographic Failures (1) — Encoding, Hashing, Encryption and HTTPS
Why Base64 is not encryption and how hashing differs from encryption. We catch tampered data with AES-GCM, use RandomNumberGenerator instead of Random for password reset codes, see why MD5 is wrong for passwords, turn on the CA5351 and CA5394 analyzers, and inspect HTTPS redirection and HSTS defaults in ASP.NET Core with curl.
OWASP A04: Cryptographic Failures (2) — Password Storage, Data Protection and Secret Management
How exactly does ASP.NET Core Identity's PasswordHasher store a password? We decode the hash header to see PBKDF2-HMAC-SHA512 with 100,000 iterations, move to OWASP's 220,000 with SuccessRehashNeeded, build a signed, time-limited share link with the Data Protection API, and keep secrets out of the code with user-secrets and environment variables.
OWASP A05: Injection (1) — SQL Injection and Command Injection
We write the same book search endpoint with string concatenation, an ADO.NET parameter, Dapper and EF Core, and see how a parameter turns ' OR 1=1 -- into plain data. We examine FromSqlRaw vs FromSql through the EF1002 warning and ToQueryString, use ArgumentList and an allowlist instead of a shell in Process.Start, and clarify where input validation fits with .NET 10's built-in validation.
OWASP A05: Injection (2) — XSS, Razor Encoding, innerHTML, CSP and Trusted Types
We examine reflected, stored and DOM-based XSS in the Bookstore lab: HtmlEncoder and Razor's automatic encoding, the trap of writing a value from a JSON API with innerHTML and the textContent fix, Angular's sanitization and the bypassSecurityTrust* risk, then how CSP and Trusted Types stop unsafe code in headless Chrome as a second line of defense.
OWASP A06: Insecure Design — Business Logic Flaws, Race Conditions and Rate Limiting
An order endpoint that works correctly line by line refunds money for a negative quantity, accepts a single-use coupon twice and sells the last copy to two people. We separate design flaws from implementation bugs, find the missing requirements with STRIDE and abuse cases, and fix them with a conditional UPDATE, a transaction, .NET 10 validation and rate limiting.
OWASP A07: Authentication Failures (1) — Brute Force, Lockout and NIST Password Rules
We start with a login endpoint that accepts unlimited attempts and reveals whether a user exists through its message and its response time. We separate brute force from credential stuffing, compare Identity's default password rules with NIST SP 800-63B-4, fix it with a blocklist validator, lockout and a uniform response, and take a short look at MFA and passkeys.