Security in Angular 2
summary
Angular 2 escapes or sanitizes every binding by default and treats different contexts separately — HTML, CSS, script, URL and resource URL — so innerHTML only allows a safe subset and URLs that could run code are rejected. For embeds that must be allowed the DomSanitizer provides explicit escape hatches like bypassSecurityTrustResourceUrl and bypassSecurityTrustHtml, but code must validate inputs (example: regex-check YouTube IDs) and call bypass as close to validation as possible. Ahead-of-Time compilation removes the template compiler to prevent template injection; direct DOM access and misuse of bypass calls remain the main risks.
AI-written summary · about
chapters (7)
- 0:00Introduction to Angular security
- 1:54Cross-site scripting risks
- 7:14Escaping vs sanitization
- 13:14Context-based sanitization
- 15:22Bypassing security safely
- 21:02Template injection prevention
- 22:04Security review and updates
related talks
17mThere's Safety in Angular
27mSecuring Angular with Trusted Types
31mBoosting the security of your Angular 2 application
25mSecuring Angular with Trusted Types
31mAngular and the OWASP top 10
19mKeeping the Sand Out of Your Eyes No Sandbox, No Problem
49mAn Abusive Relationship with AngularJS
48mSecurity Risk: Single-Page Applications.