Angular and the OWASP top 10
summary
Advocates HTTPS everywhere with Let's Encrypt and HSTS, recommends cookie Secure/HttpOnly and host prefixes, warns CORS misconfiguration can leak tokens (real crypto wallet theft example) and broken access control exposed ~76 million T‑Mobile records, praises Angular’s built‑in XSS protections but forbids bypassSecurityTrust for untrusted input, suggests compartmentalizing secrets in an isolated origin/iframe, urges use of subresource integrity for CDN files, and pushes dependency scanning — run npm audit (example project shows 27 vulnerabilities; one malicious npm had ~2M installs).
AI-written summary · about
chapters (7)
- 0:00Intro
- 0:15The top 10
- 3:30HTTPS
- 7:39Authentication
- 22:32Crosssite scripting
- 26:09NPM packages
- 29:11AUSA top 10
related talks
31mAngular and the OWASP top 10
41mWeb Security
17mThere's Safety in Angular
31mBoosting the security of your Angular 2 application
38mThe Security Toolbox For Node
53mng-owasp: OWASP Top 10 for AngularJS Applications
16mEliminating XSS Angular applications by adopting TT
29mA bit of Web Application Security