As discussed in one of the earlier sections, XSS attacks happen when attackers are able to inject malicious code (JavaScript) into the HTTP request/response or store them in database. Thereby, updating the DOM tree as the malicious code gets executed as part of page getting loaded. Execution of malicious code may result in scenarios such as users' data getting stolen or session being hijacked, and so on. In order to prevent XSS attacks, the key is to prevent attackers from injecting malicious code into the DOM tree. The following is an Angular security model for preventing XSS attacks:
- By default, Angular sanitizes all data: All values are treated as unsafe by Angular. That essentially means that all values before getting updated to DOM tree are sanitized and escaped appropriately.
- Avoid dynamic generation of template code: Template code such as HTML, attributes, and binding expressions are considered to be trusted data by Angular. Thus, as a recommended practice,...