Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
OWASP A07: Authentication Failures (2) — Cookie Flags, JWT Validation and CSRF
We look at how identity is carried on every request after login. We set cookie flags and the __Host- prefix explicitly, explain the session fixation risk, validate issuer, audience, lifetime, signature and algorithm in JwtBearer, measure the effect of ClockSkew on an expired token second by second, and show how antiforgery and SameSite work together against CSRF.
OWASP A07: Authentication Failures (1) — Brute Force, Lockout and NIST Password Rules
We start with a login endpoint that accepts unlimited attempts and reveals whether a user exists through its message and its response time. We separate brute force from credential stuffing, compare Identity's default password rules with NIST SP 800-63B-4, fix it with a blocklist validator, lockout and a uniform response, and take a short look at MFA and passkeys.
Connecting to GitHub: HTTPS, Personal Access Tokens and SSH
From creating a repo on GitHub to the first push: why passwords stopped working in 2021, fine-grained versus classic personal access tokens, how credential helpers work, ed25519 SSH keys, gh auth login and transfer.credentialsInUrl, which catches tokens embedded in URLs.
Authentication with JWT in ASP.NET Core Web API: Issuing and Validating Tokens
From the authentication vs authorization split to the anatomy of a JWT, we build a login flow with AddJwtBearer and JsonWebTokenHandler. ClockSkew, claim mapping and the refresh token idea are covered too.