Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Polymorphic Associations: Attaching Comments and Files to Multiple Tables
Linking attachments to several tables with an EntityType/EntityId pair loses FKs, cascade delete and safe authorization; when owner types are few and stable, use an exclusive arc with one nullable FK per owner and a check constraint requiring exactly one. Derive authorization from the owner's policy, not from the attachment itself.
OWASP A01: Broken Access Control (1) — IDOR, Admin Endpoints and Authorization in ASP.NET Core
Logged in as Alan, we read Grace's order by changing the order number and pull every user from an admin endpoint whose role check was forgotten. We show both flaws in the lab and close them with policies, resource-based authorization through IAuthorizationService and a deny-by-default fallback policy, and discuss choosing between 403 and 404 and the .NET 10 change to cookie redirects.
Authorization in ASP.NET Core Web API: Roles, Policies and Resource-Based Authorization
We start with [Authorize] and FallbackPolicy, then move to roles, policies, our own requirement and handler, and resource-based authorization. We see the RoleClaimType trap and 401 vs 403 with curl.