Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Antiforgery in Depth: CSRF Protection with Cookie Authentication, SPAs and Minimal APIs
ASP.NET Core's antiforgery middleware does not reject requests; it writes the result to a feature, and in minimal APIs only form binding enforces it, so cookie-authenticated JSON endpoints accept token-less requests with 200. With real output we cover the token pair internals, Angular's XSRF-TOKEN pattern, an endpoint filter that enforces validation, refreshing the token after login and deliberate use of DisableAntiforgery.
Razor Pages with htmx: Interactive UI Without an SPA, Partial Responses and Antiforgery
With htmx, Razor Pages handlers return the full page or just a partial depending on the HX-Request header; live search, infinite scroll and inline editing work without JSON or an SPA. We carry the antiforgery token with hx-headers and show the Vary and history restore pitfalls, htmx 2's 4xx behavior and htmx 4 differences with real requests.
Forms in MVC and Razor Pages: Model Binding, Post-Redirect-Get, Antiforgery and Overposting
In MVC controllers the form tag helper produces an antiforgery token but nothing validates it: a tokenless curl request saved a book until AutoValidateAntiforgeryTokenAttribute turned it into a 400. With real requests we cover Post-Redirect-Get and TempData, sending the token in a fetch header, binding collections, nested objects, checkboxes and enums plus the index gap, overposting that set stock to 999 through an entity, and how [Bind] wipes data on updates.