Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
OWASP A05: Injection (2) — XSS, Razor Encoding, innerHTML, CSP and Trusted Types
We examine reflected, stored and DOM-based XSS in the Bookstore lab: HtmlEncoder and Razor's automatic encoding, the trap of writing a value from a JSON API with innerHTML and the textContent fix, Angular's sanitization and the bypassSecurityTrust* risk, then how CSP and Trusted Types stop unsafe code in headless Chrome as a second line of defense.
Migrating from JavaScript to TypeScript: checkJs, JSDoc and Gradual strict
We walk through migrating a JavaScript project to TypeScript gradually: allowJs, checkJs and // @ts-check, writing types with JSDoc, the JSDoc changes in TypeScript 7, gradual strict and @ts-expect-error.
JavaScript's Next Features: TC39 Stages, Temporal and using
We learn how a feature passes TC39's stages into the language, how Temporal (PlainDate, ZonedDateTime, Duration) fixes Date's problems, and resource management with using, with notes on Safari support.
JavaScript Web Components: Custom Elements, Shadow DOM and Slots
We write our own HTML tag with customElements.define, learn the lifecycle callbacks and observedAttributes, and build a framework-free star rating component with Shadow DOM, template and slot.
Drawing with JavaScript Canvas: 2D Context, Animation and Pixel Data
We draw shapes, paths, gradients and text with the canvas 2D context, process images pixel by pixel, build an animation loop with requestAnimationFrame and fix blurriness on retina screens.
Files and Binary Data in JavaScript: File, Blob, ArrayBuffer and Typed Arrays
We take files from the user via input and drag and drop, read Blobs and Files, go down to bytes with ArrayBuffer, typed arrays and DataView, and learn ES2026's base64/hex methods and file downloads.
JavaScript Observer APIs: Intersection, Mutation and Resize Observer
We build lazy loading and infinite scroll with IntersectionObserver, watch DOM changes with MutationObserver and element size with ResizeObserver, and learn how to clean observers up properly.
JavaScript Web Workers: postMessage, Transferable Objects and Module Workers
We move heavy work off the main thread with Web Workers and learn postMessage and structured clone, single-file Blob URL workers, transferable objects, module workers and life without the DOM.
JavaScript Performance Tips: Debounce, Throttle and Layout Thrashing
We learn to measure with performance.now, mark and measure, write our own debounce and throttle, and cover requestAnimationFrame, layout thrashing, lazy loading and the DevTools Performance tab.
JavaScript Memory Management: Garbage Collection, Memory Leaks and WeakRef
We look at the stack and heap, reachability and garbage collection, then cover leaks from forgotten listeners, timers, closures and detached DOM, plus WeakMap, WeakRef and heap snapshots in DevTools.
JavaScript Proxy and Reflect: Traps, Validation and Reactivity
We intercept reads, writes and deletes on an object with Proxy and keep default behavior with Reflect, then build validation, default values and a reactive UI while covering the pitfalls and the cost.
JavaScript Async Iterators: for await...of, Async Generators and Array.fromAsync
We walk through data that arrives over time with Symbol.asyncIterator and async generators, learn for await...of and ES2026's Array.fromAsync, read a paginated API as a stream and meet ReadableStream.