Anil Singh | Code-sample.com

JavaScript Code- < script type = "text/javascript" >   var app = angular . module ( 'App' , [ "ngSanitize" ]);   app . controller ( 'AppCtrl' , [ '$scope' , '$sce' , function ( $scope , $sce ){     $scope . name = "" ;     $scope . processHtmlCode = function () {        $scope . trustedMessage =  $sce . trustAsHtml ( $scope . name );     }   }]); </ script > HTML code- < span ng-bind-html = "trustedMessage" ></ span > How To Preventing Cross Site Scripting (XSS) in Angular?  How Angular Protects Us From XSS Attacks? I hope you are enjoying with this post! Please share with you friends. Thank you so much!

The Angular treats all values as untrusted by default. This is the great advantages of Angular. Example 1 - import { BrowserModule , DomSanitizer } from '@angular/platform-browser' @ Component ({   selector : 'my-app' ,   template : `< div [ innerHtml ]= "html" ></ div >`, }) export class App {   constructor ( private sanitizer : DomSanitizer) {     this . html = sanitizer . bypassSecurityTrustHtml ( '<h1>DomSanitizer</h1><script>alert("XSS")</script>' ) ;   } } Example 2 - import { BrowserModule , DomSanitizer } from '@angular/platform-browser' @ Component ({   selector : 'my-app' ,   template : `< iframe [ src ]= "iframe" ></ iframe >`, }) export class App {   constructor ( private sanitizer : DomSanitizer) {     this . iframe = sanitizer . bypassSecurityTrustResourceUrl ( "https://www.code-sam...

Security Principles For Angular's Regular Web Applications - 1.      You should avoid direct use of the DOM APIs. 2.      You should enable Content Security Policy (CSP) and configure your web server to return appropriate CSP HTTP headers. 3.      You should Use the offline template compiler. 4.      You should Use Server Side XSS protection. 5.      You should Use DOM Sanitizer. 6.      You should Preventing CSRF or XSRF attacks. Example – export const BROWSER_SANITIZATION_PROVIDERS: Array < any > = [   { provide : Sanitizer , useExisting : DomSanitizer },   { provide : DomSanitizer , useClass : DomSanitizerImpl }, ]; @ NgModule ({   providers : [     BROWSER_SANITIZATION_PROVIDERS     ...   ],   exports : [ CommonModule , ApplicationModule ] }) export class B...

How does Angular 2 handle with XSS or CSRF?  How Angular prevents this Attacks? The Cross Site Scripting (XSS) attack is a type of injection and attackers inject your web applications using the client side scripts and malicious code into web pages. An attacker can insert vulnerability scripts and malicious code in your web applications. The Angular treats all values as un-trusted by default. This is the great advantages of Angular. Stayed Informed   –  Angular 4 docs  and  Angular 5 docs When a value is Inserted Vulnerability into the DOM from – 1.      A Template 2.      Property 3.      Attribute 4.      Style 5.      Class Binding 6.      Interpolation 7.      And so on. Angular recognizes the value as unsafe and automatically sanitizes and removes the script tag and other securit...