Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
OWASP A01: Broken Access Control (2) — Path Traversal, CORS and SSRF
A download endpoint that takes a file name from the client, a CORS policy that echoes back every origin and cover-download code that requests whatever URL it is given. We examine the three vulnerable patterns and close them with a canonical path check, a policy that lists origins one by one and an HttpClient with an allowlist, disabled redirects and an IP check in ConnectCallback, then watch the fixed code reject bad input in the lab.
OWASP A01: Broken Access Control (1) — IDOR, Admin Endpoints and Authorization in ASP.NET Core
Logged in as Alan, we read Grace's order by changing the order number and pull every user from an admin endpoint whose role check was forgotten. We show both flaws in the lab and close them with policies, resource-based authorization through IAuthorizationService and a deny-by-default fallback policy, and discuss choosing between 403 and 404 and the .NET 10 change to cookie redirects.
The Security Lab: A Bookstore API with ASP.NET Core 10 and Reading HTTP with curl
We set up the lab for the rest of the series: an ASP.NET Core 10 minimal API on SQLite. With curl -i we read methods, status codes, headers and cookies through a security lens, see how the same error reaches the client differently in Development and Production, and cover the HTTPS development certificate and the lab rules.
An Introduction to Web Security: What Is the OWASP Top 10:2025 and How to Read It
Why security can't be a feature added later. We start with a small endpoint that returns another customer's order, then cover the CIA triad and the attack surface, what OWASP is, why the Top 10 is an awareness document rather than a standard, how the list is built from data and a survey, and the ten categories of the 2025 list.