Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Putting the OWASP Top 10 Together: Secure Defaults for ASP.NET Core and Angular
We put the ten categories together in a single Program.cs: fallback policy, cookie flags, ProblemDetails, rate limiting that returns 429, security headers and rejecting unknown JSON fields. We verify everything with curl, do SAST with the .NET analyzers, write security regression tests with WebApplicationFactory, and talk about DAST and moving to ASVS 5.0.
OWASP A05: Injection (2) — XSS, Razor Encoding, innerHTML, CSP and Trusted Types
We examine reflected, stored and DOM-based XSS in the Bookstore lab: HtmlEncoder and Razor's automatic encoding, the trap of writing a value from a JSON API with innerHTML and the textContent fix, Angular's sanitization and the bypassSecurityTrust* risk, then how CSP and Trusted Types stop unsafe code in headless Chrome as a second line of defense.
Angular 22: OnPush by Default, Stable Signal Forms and a File-by-File Comparison with Angular 12
In Angular 22 OnPush is the default, Signal Forms and the resource APIs are stable, and HttpClient uses Fetch. We also cover the yearly major cadence and a file-by-file diff with an Angular 12 project.
Angular 21: Zoneless by Default, Experimental Signal Forms and Vitest
In Angular 21 new projects start without Zone.js, Signal Forms arrive as an experiment and become [formField] in 21.1, and Vitest becomes the default test runner. We compare it all with Angular 12.
Angular 20: Stable Signal APIs, httpResource and the New File Naming
In Angular 20, effect, toSignal and linkedSignal become stable, resource swaps request for params, httpResource arrives, app.ts replaces app.component.ts and *ngIf gets deprecated.
Angular 19: Standalone by Default, linkedSignal and Data Loading with resource()
In Angular 19 you no longer write standalone: true. We compare linkedSignal for dependent state and the experimental resource() and rxResource for data loading with the Angular 12 way.
What's New in Angular 18: Zoneless Change Detection, @let and Stable Control Flow
Experimental zoneless change detection in Angular 18, control flow and @defer going stable, @let from 18.1, ng-content fallback content, unified form events and redirect functions.
What's New in Angular 17.x: input(), model(), output() and Signal Queries
input(), input.required(), model(), output() and the viewChild()/viewChildren() signal queries from Angular 17.1–17.3, side by side with their Angular 12 @Input, @Output and @ViewChild counterparts.
What's New in Angular 17: @if, @for, @defer and the New Application Builder
The @if, @for and @switch control flow, @defer and its triggers, the esbuild and Vite based application builder and standalone ng new in Angular 17, compared with Angular 12.
What's New in Angular 16: Signals, Required Inputs and takeUntilDestroyed
Signals, computed and effect, the toSignal/toObservable bridge, required inputs and transforms, and subscription cleanup with takeUntilDestroyed in Angular 16, compared with Angular 12.
Angular 15: Functional Guards, Functional Interceptors, hostDirectives and NgOptimizedImage
The second half of Angular 15: functional guards with CanActivateFn, functional interceptors with withInterceptors, composing directives with hostDirectives, and NgOptimizedImage with ngSrc.
Standalone APIs in Angular 15: bootstrapApplication, provideRouter and Apps Without NgModule
Angular 15 made the standalone APIs stable. We build an app without AppModule using bootstrapApplication, provideRouter, provideHttpClient and importProvidersFrom, then migrate step by step.