Security

Security best practices for Angular (XSS, CSP, Route Guards).

majiayu000 4ec09f8 2 files · 1.6 KB Updated 567 repo stars

File contents

Security

Priority: P0 (CRITICAL)

Principles

  • XSS Prevention: Angular sanitizes by default. Do NOT use innerHTML unless absolutely necessary.
  • Bypass Security: Avoid DomSanitizer.bypassSecurityTrust... unless the content source is trusted.
  • Route Guards: Protect all sensitive routes with CanActivateFn.

Guidelines

  • CSP: Configure Content Security Policy headers on the server.
  • HTTP: Use Interceptors to attach secure tokens (HttpOnly cookies preferred over LocalStorage tokens).
  • Secrets: NEVER store secrets (API keys) in Angular code.

References

  • Security Best Practices

Related Topics

common/security-standards | components

majiayu000/claude-skill-registry-data/tree/main/security/security-hoangnguyen0403-agent-skills-standar-6 commit 4ec09f800f

Frequently asked questions

npx skillmds add majiayu000/security-24