Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Sensitive Data in Logs: Redaction, Data Classification and Privacy-Compliant Logging
The way to keep sensitive data out of logs is to classify it and mask it automatically in the logging pipeline. Taxonomy and attributes with Microsoft.Extensions.Compliance.Redaction, [LogProperties], ErasingRedactor, your own redactor and the HMAC redactor that keeps correlation; masking with destructuring in Serilog, personal data in exception messages and a FakeLogger test that catches it, with real output.
CORS and Security in ASP.NET Core Web API: HTTPS, HSTS, Headers and Secrets
We see with curl why CORS is not a firewall, define a policy and read the preflight request. HTTPS redirection, the localhost exception in HSTS, security headers and user secrets are covered too.
Authorization in ASP.NET Core Web API: Roles, Policies and Resource-Based Authorization
We start with [Authorize] and FallbackPolicy, then move to roles, policies, our own requirement and handler, and resource-based authorization. We see the RoleClaimType trap and 401 vs 403 with curl.
Authentication with JWT in ASP.NET Core Web API: Issuing and Validating Tokens
From the authentication vs authorization split to the anatomy of a JWT, we build a login flow with AddJwtBearer and JsonWebTokenHandler. ClockSkew, claim mapping and the refresh token idea are covered too.