Angular · Theory
Angular sanitizes template bindings by default. Don’t bind untrusted HTML with [innerHTML] unless you ran DomSanitizer.bypassSecurityTrustHtml after you really trust it.
XSS is the viva word: user bio with <script>. Keep it text. CSRF on cookie APIs — HttpClient has helpers. Trap: bypass sanitizer ‘to make it work’ on user content.
XSS + why not innerHTML. Sanitizer.
import { Component } from "@angular/core";
@Component({
selector: "app-root",
template: `
<h1>{{ title }}</h1>
<button (click)="toggle()">Toggle</button>
<p *ngIf="open">Panel open</p>
`,
})
export class AppComponent {
title = "Angular practice";
open = true;
toggle() {
this.open = !this.open;
}
}Security: toggle open. Say whether the panel is on screen after one click.