Angular and the OWASP top 10

on YouTube ↗31m

" summary

Claims that Angular auto-sanitizes bindings and blocks common XSS vectors while still requiring explicit trust for resource URLs and bypass APIs, shows a live XSS payload example, warns against using element refs or jQuery, and recommends OAuth/OIDC for authentication flows. Gives a concrete dependency risk metric — 97% of app code comes from dependencies — and recounts an npm supply‑chain compromise. Advises tools: GitHub dependency graph, OWASP dependency‑check, and Snyk, and links to an Angular security cheat sheet that collects the rules.

AI-written summary · about

" chapters (4)

1. 0:00Angular security overview
2. 2:50Cross-site scripting
3. 16:11Authentication strategies
4. 22:25Managing dependency risks

" related talks

• 32mAngular and the OWASP top 10Philippe De Ryck · NG-BE 2018
• 53mng-owasp: OWASP Top 10 for AngularJS ApplicationsKevin Hakanson · DevFestMN 2016
• 17mThere's Safety in AngularAlisa Duncan · ng-conf 2022
• 51mAn Abusive Relationship with AngularJSMario Heiderich · CODE BLUE 2015
• 49mAn Abusive Relationship with AngularJSMario Heiderich · beyond tellerrand // DÜSSELDORF 2016
• 31mBoosting the security of your Angular 2 applicationPhilippe De Ryck · NG-BE 2016
• 25mSecuring Angular with Trusted TypesPhilippe De Ryck · NG-DE Conference 2022
• 45mAn Abusive Relationship with AngularJS v2Mario Heiderich · RuhrSec 2016