Boosting the security of your Angular 2 application
summary
Angular 2 claims to stop XSS by auto-escapes and sanitizes untrusted data, and it offers an ahead-of-time compilation path that prevents template-injection when templates are compiled before shipping. The recommended defenses are Content Security Policy with nonce + strict-dynamic and report-uri monitoring; Google finds 95% of CSP policies bypassable when naively whitelisting CDNs. Demos show CSP blocking inline scripts and nonced scripts working; AOT removes client-side template attack surface.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 0:58Browser exploitation framework
- 1:49About me
- 2:21Crosssite scripting
- 3:41Defending against crosssite scripting
- 10:35Dont disable sanitizer
- 11:22Takeaways
- 13:41Expression Sandbox
- 14:25Ahead of time compilation
- 15:13Get rid of template injection
- 15:37Handling crosssite scripting
- 16:13Content Security Policy
- 18:57Whitelisting
- 21:21Strict Dynamic
- 23:24CSP Policy
- 28:08CSP Lockdown
- 29:14Conclusion
- 29:45Outro
