Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
OWASP A07: Authentication Failures (2) — Cookie Flags, JWT Validation and CSRF
We look at how identity is carried on every request after login. We set cookie flags and the __Host- prefix explicitly, explain the session fixation risk, validate issuer, audience, lifetime, signature and algorithm in JwtBearer, measure the effect of ClockSkew on an expired token second by second, and show how antiforgery and SameSite work together against CSRF.
Authorization in ASP.NET Core Web API: Roles, Policies and Resource-Based Authorization
We start with [Authorize] and FallbackPolicy, then move to roles, policies, our own requirement and handler, and resource-based authorization. We see the RoleClaimType trap and 401 vs 403 with curl.
Authentication with JWT in ASP.NET Core Web API: Issuing and Validating Tokens
From the authentication vs authorization split to the anatomy of a JWT, we build a login flow with AddJwtBearer and JsonWebTokenHandler. ClockSkew, claim mapping and the refresh token idea are covered too.