Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
API7 and API10: APIs That Talk to the Outside World — Webhooks, Outbound URL Validation and Not Trusting Third-Party Responses
You validate a user-supplied webhook URL by shape at registration and, at connect time, on every resolved address with SocketsHttpHandler.ConnectCallback, and you treat third-party responses like user input. A DNS rebinding imitation, delivery without redirects, a signed payment webhook processed once, and a shipping API response validated with a size limit and resilience.
Angular SSR Security: allowedHosts, Host Header Validation, TransferState and Secrets Leaking into Bundles
In Angular SSR the server resolves relative HttpClient URLs against the incoming request's Host header, so fill allowedHosts with explicit names, trust proxy headers only behind a trusted proxy and do not derive the API address from Host. On a local SSR server we show SSRF, the 2026 advisories, fields leaking into TransferState, a nonce-based CSP under SSR and secrets ending up in bundles and source maps, all with real output.
OWASP A01: Broken Access Control (2) — Path Traversal, CORS and SSRF
A download endpoint that takes a file name from the client, a CORS policy that echoes back every origin and cover-download code that requests whatever URL it is given. We examine the three vulnerable patterns and close them with a canonical path check, a policy that lists origins one by one and an HttpClient with an allowlist, disabled redirects and an IP check in ConnectCallback, then watch the fixed code reject bad input in the lab.