Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
OWASP A07: Authentication Failures (2) — Cookie Flags, JWT Validation and CSRF
We look at how identity is carried on every request after login. We set cookie flags and the __Host- prefix explicitly, explain the session fixation risk, validate issuer, audience, lifetime, signature and algorithm in JwtBearer, measure the effect of ClockSkew on an expired token second by second, and show how antiforgery and SameSite work together against CSRF.
OWASP A07: Authentication Failures (1) — Brute Force, Lockout and NIST Password Rules
We start with a login endpoint that accepts unlimited attempts and reveals whether a user exists through its message and its response time. We separate brute force from credential stuffing, compare Identity's default password rules with NIST SP 800-63B-4, fix it with a blocklist validator, lockout and a uniform response, and take a short look at MFA and passkeys.