Blog

Mert Özen's blog posts on software development, backend, frontend, and DevOps.

Series

.NET Core Web API 36 Angular 31 JavaScript Basics 19 JavaScript Intermediate 18 JavaScript Advanced 16 TypeScript Basics 14 TypeScript Intermediate 14 TypeScript Advanced 12 Entity Framework Core 28 Dapper 16 Git & GitHub 29 Web Security (OWASP Top 10) 21 LLM Fundamentals 20 C# Fundamentals 20 Object-Oriented Programming in C# 16 C# Collections and Generics 11 LINQ 17 Asynchronous Programming in C# 17 Advanced C# 14 C# Versions 6 Solution Patterns 22 SOLID and Design Principles 12 Clean Code 13 Design Patterns 23 UML and Modeling 18 Introduction to Software Architecture 9 Clean, Onion and Hexagonal Architecture 8 Vertical Slice Architecture 6 Domain-Driven Design 12 CQRS and Event Sourcing 10 Messaging and Event-Driven Architecture 9 Modular Monolith 2 Microservices 10 UI Architecture Patterns 9 Architecture Decisions 7 System Design 15 Distributed Systems Fundamentals 11 Background Jobs and Scheduled Jobs 11 Working with Message Queues 14 Logging in .NET 10 Caching 10 Real-time Applications 9 ASP.NET Core MVC and Razor Pages 13 CI/CD Fundamentals 8 GitHub Actions 16 Jenkins 12 Web Servers and Hosting 12 Deployment Strategies 9 Kubernetes 19 Authentication and Authorization 18

3 posts found #dotnet-11

Newest Oldest Popular

Security PART 08

ASP.NET Core Security in .NET 11: Automatic CSRF Protection with Fetch Metadata, Device Bound Session Credentials and TLS Channel Binding

.NET 11 adds CSRF protection, on by default for apps built with WebApplication.CreateBuilder, that checks the Sec-Fetch-Site and Origin headers; yet only form-reading endpoints enforce the verdict and DisableAntiforgery turns it off too. We cover the decision table, origins trusted through CORS, a middleware applying the same rules on .NET 10, experimental DBSC, TLS channel binding, unified authorization metadata and a migration checklist.

8 Nov 2026 10 min 6

Backend PART 09

What's New in Real-time from .NET 8 to .NET 11: Stateful Reconnect, Native AOT, SSE and SignalR Authentication Refresh

.NET 8 brought stateful reconnect, .NET 9 polymorphic hub parameters, an ActivitySource and Native AOT for SignalR, .NET 10 TypedResults.ServerSentEvents, and .NET 11 adds authentication refresh that renews the token without dropping the connection. A 28 MB vs 82 MB AOT measurement, the strongly typed hub AOT warning, cancellable hub calls, SSE in OpenAPI 3.2 and legacy ASP.NET SignalR.

8 Nov 2026 11 min 6

Backend PART 10

What's New in Logging from .NET 8 to .NET 11: Enrichment, Redaction, FakeLogger, Buffering and Generic LoggerMessage

Logging in .NET moves on two trains: ILogger and the source generator ship with the runtime, while enrichment, redaction, FakeLogger, sampling and buffering come with the monthly Microsoft.Extensions.Telemetry packages. With real output we show which feature arrived when, CA1873 and the obsolete AddServiceLogEnricher in .NET 10, generic LoggerMessage in .NET 11, and how to read old Serilog Startup code.

8 Nov 2026 12 min 4