Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Real-World Bug Hunts 2: Frontend and Integration — Cache, CORS, Dates and Memory Leaks
Most frontend bugs are born not in the code but in the gap between browser and server. Five real cases: a white screen after deploy from a cached index.html and missing chunks, a CORS preflight failing only in production because of a trailing slash, a birth date shifting by a day across time zones, floating point money totals and memory growing from an observable never unsubscribed; with the decisive tool for each and the series' debugging checklist.
OWASP A01: Broken Access Control (2) — Path Traversal, CORS and SSRF
A download endpoint that takes a file name from the client, a CORS policy that echoes back every origin and cover-download code that requests whatever URL it is given. We examine the three vulnerable patterns and close them with a canonical path check, a policy that lists origins one by one and an HttpClient with an allowlist, disabled redirects and an IP check in ConnectCallback, then watch the fixed code reject bad input in the lab.
CORS and Security in ASP.NET Core Web API: HTTPS, HSTS, Headers and Secrets
We see with curl why CORS is not a firewall, define a policy and read the preflight request. HTTPS redirection, the localhost exception in HSTS, security headers and user secrets are covered too.
JavaScript Fetch API: GET, POST, response.ok, Timeouts and an Intro to CORS
We fetch and send data with the Fetch API and see why a 404 skips catch, how response.ok helps, POST/PUT/DELETE, timeouts with AbortSignal.timeout, CORS, and showing loading and error states.