Angular Security
XSS, CSP, Trusted Types, OAuth and OIDC – what really protects an Angular application and how your team implements it.
- 2 Days
- Intermediate
- Remote or in-house
- German & English
Is this training right for your team?
Who it’s for
- Angular developers
- Teams whose applications handle logins, tokens or sensitive data
- Teams preparing for a security audit
Afterwards your team can
- Prevent XSS in Angular and use Trusted Types
- Set up a Content Security Policy for their own app
- Handle tokens in the browser safely and integrate OAuth 2.x/OIDC correctly
- Check their own application for vulnerabilities
Prerequisites
- Practical Angular experience
- Basic knowledge of HTTP and browser security helps but is not required
- A laptop with your usual development setup
Angular protects against many attacks out of the box – but not all of them, and not when it is used the wrong way. In two days your team learns the basics of browser security, XSS defense with Trusted Types, a Content Security Policy for Angular and how to handle tokens, OAuth 2.x and OIDC safely – with your own application as the example.
Need the framework-independent fundamentals first, or your team doesn’t work with Angular? Then start with Introduction to Web Security.
Agenda
The order and the depth of each block are adapted to your team – topics you already master are skipped, your questions get the time instead.
Browser security fundamentals
- Same-origin policy and cross-origin resource sharing (CORS)
- Configuring browser security mechanisms
- Dealing with malicious JavaScript
Introduction to Cross-Site Scripting (XSS)
- XSS defense in Angular / DomSanitizer
- XSS pitfalls in Angular
- Using Trusted Types with Angular
Applying the Content Security Policy (CSP)
- Introduction to CSP
- Common security mistakes in CSP policies
- Deploying CSP for Angular
- CSP in practice
- Secure frontend architectures
Sandboxing untrusted content
- Architectural security patterns
- Securing tokens in the browser
- Advanced OAuth 2.0/2.1 security
Common OAuth 2.x and OIDC deployment patterns
- Security limitations of OAuth 2.x in frontends
- Securing frontends with a backend for frontend (BFF)
- Security recommendations for using OAuth 2.x in Angular
Introduction to testing a web application for vulnerabilities
- Manual and automated tools
- Static and dynamic analysis to scan for vulnerabilities
Your trainer
Martina Kraus
Google Developer Expert
Application Security Engineer and Google Developer Expert, speaks about web security at international conferences and co-organizes NG-DE.
Full profile →
Bring this training to your team
For your team only – remote or at your office, on dates that suit you, with examples from your own code base where it helps.
- up to 12 participants (more on request)
- from CHF 2,400 per day for the whole team
- On site: plus travel at cost
- Fixed quote within one business day
- Agenda as PDF – to forward to your manager
Newsletter
Only the latest articles and announcements.
No spam. Promised. By subscribing you agree to our privacy policy.
