Angular Security

XSS, CSP, Trusted Types, OAuth and OIDC – what really protects an Angular application and how your team implements it.

2 Days
Intermediate
Remote or Inhouse
German & English

Request this training See the agenda

Who it’s for

Angular developers
Teams whose applications handle logins, tokens or sensitive data
Teams preparing for a security audit

Afterwards your team can

Prevent XSS in Angular and use Trusted Types
Set up a Content Security Policy for their own app
Handle tokens in the browser safely and integrate OAuth 2.x/OIDC correctly
Check their own application for vulnerabilities

Prerequisites

Practical Angular experience
Basic knowledge of HTTP and browser security helps but is not required
A laptop with your usual development setup

This course covers the fundamentals of web security, including an introduction, the Same-Origin Policy and Cross-Origin Resource Sharing, configuring browser security mechanisms, dealing with malicious JavaScript, an introduction to Cross-Site Scripting (XSS), XSS defense in Angular, using Trusted Types, applying the Content Security Policy (CSP), secure frontend architectures, sandboxing untrusted content, architectural security patterns, securing tokens in the browser, advanced OAuth 2.0/2.1 security, the security limitations of OAuth 2.x in frontends, an introduction to vulnerability testing, and the use of manual and automated tools for security analysis.

Agenda

The order and the depth of each block are adapted to your team – topics you already master are skipped, your questions get the time instead.

01
Introduction
- Same-Origin Policy and Cross-Origin Resource Sharing
- Configuring browser security mechanisms
- Dealing with malicious JavaScript
02
Introduction to Cross-Site Scripting (XSS)
- XSS defense in Angular / DomSanitizer
- XSS pitfalls in Angular
- Using Trusted Types with Angular
03
Applying the Content Security Policy (CSP)
- Introduction to CSP
- Common security mistakes in CSP policies
- Deploying CSP for Angular
- CSP in practice
- Secure frontend architectures
04
Sandboxing untrusted content
- Architectural security patterns
- Securing tokens in the browser
- Advanced OAuth 2.0/2.1 security
05
Common OAuth 2.x and OIDC deployment patterns
- Security limitations of OAuth 2.x in frontends
- Securing frontends with a Backend-For-Frontend (BFF)
- Security recommendations for using OAuth 2.x in Angular
06
Introduction to testing a web application for vulnerabilities
- manual and automated tools
- static and dynamic analysis for scanning for security vulnerabilities

Your trainer

Martina Kraus
Google Developer Expert
Application Security Engineer and Google Developer Expert, speaks about web security at international conferences and co-organises NG-DE.
Full profile →