How do you handle security in an Angular app (XSS, tokens, CSRF)?
Model answer
Angular escapes values in templates by default, which prevents most cross-site scripting. Avoid bypassSecurityTrustHtml and similar methods unless you sanitise the content yourself, and never build HTML strings from user input.
For authentication, prefer HttpOnly secure cookies where possible, or keep tokens in memory and short-lived, because tokens in local storage can be stolen by an XSS bug. Use HTTPS, validate everything on the server, and protect cookie-based sessions against CSRF (Angular supports an XSRF token header). Keep dependencies updated.
Learn this topic
Angular Tutorial: Beginner to Advanced .
Sign in to add your own answer.
More questions
- How do you write a unit test for a component or a service in Angular?
- What is the difference between unit, integration and end-to-end tests?
- How do you test a component that calls an API?
- How do you test route guards, pipes and directives?
- What does ng lint and a formatter give you, and what other tooling do Angular teams use?
- How do you handle environment-specific settings in Angular?