Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Protecting the API: Access Token Validation, Audience, Scope Policies, Client Credentials and DPoP
An API must accept not every validly signed token, but only one issued for its own audience and carrying the required scope. We wire AddJwtBearer to Keycloak, map scopes to policies, use introspection to show why a signed-out user's JWT still passes, write a DelegatingHandler that caches client credentials tokens, and verify in five scenarios that a stolen DPoP-bound token is useless.
The BFF Pattern for SPAs: The Architecture RFC 10017 Recommends with Angular, ASP.NET Core and YARP
There is no safe place for tokens in the browser; the option RFC 10017 rates most secure is a BFF that keeps tokens on the server. In ASP.NET Core 10 we set up OIDC with a cookie session, attach tokens via YARP on the way to the API, renew tokens inside the BFF, defend against CSRF with a custom header and build an XHR-friendly logout; curl output shows Angular never sees a token, and we weigh the costs.
Choosing an Authorization Server: Comparing OpenIddict, Duende IdentityServer, Keycloak and Microsoft Entra ID
The right authorization server depends on what your team can operate: OpenIddict and Duende are frameworks, Keycloak a product, Entra ID a managed service. We run three in the lab, build a capability matrix from discovery documents, show why it must be read with care, and compare licenses, operational load, SAML bridging and why you should not write your own authorization server, as of November 2026.
Authorization Models: RBAC, ABAC, ReBAC and Permission-Based Design in Multi-Tenant Scenarios
Stuffing conditions into roles leads to role explosion; the fix is to use RBAC, ABAC and ReBAC as layers. We reduce roles to permission bundles, write the refund rule as a policy that returns reasoned decisions from tenant, limit and time attributes, show the Zanzibar idea with a toy relationship graph, pin it all with tests, and discuss permissions in tokens, the tenant claim and auditing impersonation.
Authentication State in Angular: Functional Guards, Interceptors, Single-Flight Token Refresh and UI Authorization
Guards and hidden buttons in Angular are user experience, not a security boundary; the real decision is made in the API. We write a signal-based auth state service, canMatch guards, a permission directive, an interceptor that ties concurrent 401s to a single refresh, and cross-tab sign-out with BroadcastChannel, test them all with Vitest, and show that a request bypassing the guard gets a 403 from the API.
What Changed in Authentication and Identity from ASP.NET Core 6 to 11
The most important authentication changes from ASP.NET Core 6 to 10 don't break the build; they silently change behavior. We run the same code on .NET 6, 8 and 10 to show a single scheme becoming the default, SecurityToken turning into JsonWebToken, cookies returning 401 instead of 302 for APIs and the new metrics; then cover PAR in .NET 9, .NET 11's TimeProvider, passkey names and DBSC, and a migration checklist.