There's Safety in Angular

on YouTube ↗17m

" summary

Claims that Angular auto-escapes interpolation and sanitizes property bindings with whitelists of allowed elements and attributes, and that unsafe URLs get an "unsafe:" prefix so they no longer execute. Demonstrations include using DomSanitizer and bypassSecurityTrustResourceUrl for trusted iframe sources, and using HttpClientXsrfModule which sends the XSRF token as a header automatically. Also lists concrete building blocks for access control: route guards, lazy loaded modules, structural directives and HTTP interceptors, with examples and DevTools inspection.

AI-written summary · about

" chapters (10)

1. 0:00Introduction
2. 0:33Security in web development
3. 2:20OWASP Top 10 vulnerabilities
4. 3:01XSS attacks and risks
5. 5:07Angular prevents injection
6. 6:33HTML sanitization in Angular
7. 9:47Bypassing Angular security
8. 12:35Cross-site request forgery and mitigation
9. 15:24Access control in Angular
10. 16:29Resources and closing

" related talks

• 24mSecurity in Angular 2Martin Probst, Raphaël Jamet · ng-europe 2016
• 31mAngular and the OWASP top 10Philippe De Ryck · AngularConnect 2019
• 25mSecuring Angular with Trusted TypesPhilippe De Ryck · NG-DE Conference 2022
• 27mSecuring Angular with Trusted TypesPhilippe De Ryck · NG-BE 2021
• 31mBoosting the security of your Angular 2 applicationPhilippe De Ryck · NG-BE 2016
• 32mAngular and the OWASP top 10Philippe De Ryck · NG-BE 2018
• 49mAn Abusive Relationship with AngularJSMario Heiderich · beyond tellerrand // DÜSSELDORF 2016
• 51mAn Abusive Relationship with AngularJSMario Heiderich · CODE BLUE 2015