Security — Angular Technical Interview Questions & Answers

Security

Security

  • Angular sanitizes template bindings by default. Don’t bind untrusted HTML with [innerHTML] unless you ran DomSanitizer.bypassSecurityTrustHtml after you really trust it.
  • XSS is the viva word: user bio with <script>. Keep it text. CSRF on cookie APIs — HttpClient has helpers. Trap: bypass sanitizer ‘to make it work’ on user content.

Technical Interview Tip: XSS + why not innerHTML. Sanitizer.

Code Examples for Security

Security — working example

import { Component } from "@angular/core";

@Component({
  selector: "app-root",
  template: `
    <h1>{{ title }}</h1>
    <button (click)="toggle()">Toggle</button>
    <p *ngIf="open">Panel open</p>
  `,
})
export class AppComponent {
  title = "Angular practice";
  open = true;
  toggle() {
    this.open = !this.open;
  }
}

Security: toggle open. Say whether the panel is on screen after one click.

How to Explain Security to an Interviewer

How does Angular help with XSS?

Sanitizes bindings Don’t bypass on user HTML