Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
OWASP A04: Cryptographic Failures (2) — Password Storage, Data Protection and Secret Management
How exactly does ASP.NET Core Identity's PasswordHasher store a password? We decode the hash header to see PBKDF2-HMAC-SHA512 with 100,000 iterations, move to OWASP's 220,000 with SuccessRehashNeeded, build a signed, time-limited share link with the Data Protection API, and keep secrets out of the code with user-secrets and environment variables.
OWASP A04: Cryptographic Failures (1) — Encoding, Hashing, Encryption and HTTPS
Why Base64 is not encryption and how hashing differs from encryption. We catch tampered data with AES-GCM, use RandomNumberGenerator instead of Random for password reset codes, see why MD5 is wrong for passwords, turn on the CA5351 and CA5394 analyzers, and inspect HTTPS redirection and HSTS defaults in ASP.NET Core with curl.
OWASP A03: Software Supply Chain Failures — NuGetAudit, npm audit and SRI
Why is A03:2025 Software Supply Chain Failures its own category? Lessons from event-stream, Log4Shell, xz, polyfill.io and the 2025 npm incidents; NuGetAudit scanning transitive dependencies on net10.0, warnings that break the build, lock files, npm audit and npm ci, SRI for CDN scripts, an SBOM with CycloneDX, provenance and Dependabot.
OWASP A02: Security Misconfiguration — Error Pages, OpenAPI, Headers and XXE
Same code, wrong settings: a developer exception page enabled unconditionally in Production dumps a stack trace, and a forgotten MapOpenApi line hands the whole API map to a customer. We fix it with ProblemDetails, per-environment configuration, AllowedHosts, a disabled Server header, a small middleware for CSP and nosniff and a look at why HSTS doesn't show up on localhost, then build a hardened XmlReader that rejects an XML document containing a DTD.
OWASP A01: Broken Access Control (2) — Path Traversal, CORS and SSRF
A download endpoint that takes a file name from the client, a CORS policy that echoes back every origin and cover-download code that requests whatever URL it is given. We examine the three vulnerable patterns and close them with a canonical path check, a policy that lists origins one by one and an HttpClient with an allowlist, disabled redirects and an IP check in ConnectCallback, then watch the fixed code reject bad input in the lab.
OWASP A01: Broken Access Control (1) — IDOR, Admin Endpoints and Authorization in ASP.NET Core
Logged in as Alan, we read Grace's order by changing the order number and pull every user from an admin endpoint whose role check was forgotten. We show both flaws in the lab and close them with policies, resource-based authorization through IAuthorizationService and a deny-by-default fallback policy, and discuss choosing between 403 and 404 and the .NET 10 change to cookie redirects.
The Security Lab: A Bookstore API with ASP.NET Core 10 and Reading HTTP with curl
We set up the lab for the rest of the series: an ASP.NET Core 10 minimal API on SQLite. With curl -i we read methods, status codes, headers and cookies through a security lens, see how the same error reaches the client differently in Development and Production, and cover the HTTPS development certificate and the lab rules.
An Introduction to Web Security: What Is the OWASP Top 10:2025 and How to Read It
Why security can't be a feature added later. We start with a small endpoint that returns another customer's order, then cover the CIA triad and the attack surface, what OWASP is, why the Top 10 is an awareness document rather than a standard, how the list is built from data and a survey, and the ten categories of the 2025 list.
Preparing for Git 3.0: What Changes, What Goes, What to Do Today
We separate the official status of Git 3.0 (BreakingChanges.adoc: no date yet) from the plan reported by GitLab and LWN. We try the main, SHA-256 and reftable defaults, safe.bareRepository, mandatory Rust, the commands being removed and why git checkout stays on Git 2.54, and end with a preparation checklist.
Git 2.50–2.56: git history, Config-Based Hooks and git add --resolved
We go from Git 2.50 to the current 2.56: git history reword and split (fixup in 2.55, drop in 2.56), config-based and parallel hooks, stash export/import, pull.autostash and what happens on a conflict, git last-modified, git repo info, reflog drop, branch --delete-merged, add --resolved and the -h exit code change.
Git 2.40–2.49: reftable, SHA-256, git replay and the New git config
We look at the 2.40–2.49 period, when the foundations of Git 3.0 were laid, with real output: the reftable ref store and git refs migrate, where SHA-256 repos stand today, git config's get/set/unset/list subcommands, worktree add --orphan, git replay, safe.directory prefixes, git backfill and Rust's first step.
Git 2.23–2.39: From checkout to switch and restore, Old Habits to New Ones
We put old and new side by side for what arrived between Git 2.23 and 2.39: the move from checkout to switch and restore, init.defaultBranch, pull's divergent branches error, sparse-checkout, maintenance, fsmonitor, ort and remerge-diff, rebase --update-refs, force-if-includes, safe.directory and SSH signing.