1

Well this is not a question of a specific problem I have it's more a general question. Yesterday I had a little argument with a friend of mine wehter or not a "high security application" (e-Banking for example) could be implemented in Angular (not specifically angular, client-side SPA's in general).

While I was sure that it would be a very bad idea to implement an e-banking application in Angular, I wasn't able to give a concrete reason, it was more like a feeling I had.

Since then I'm questioning if I might be wrong about that. I'm not very experienced in the field of application security so I'd be thankful if someone more experienced could dispel my doubts wehter I was right or not. (Preferably with explanation)

Improve this question
1
  • 1
    You might want to take a look at MyMonero.com - its a cryptocurrency web wallet in Angular, which is a high risk use case you were mentioning.
    – James Cameron
    Sep 19, 2016 at 20:51

2 Answers 2

Reset to default
1

There's no reason you can't do a security sensitive website in AngularJS or Angular2 - for the most part, the key points of security happen server side, not JS side. Yes, of course, you need to do some XSS and CSRF protections on the client (in conjunction with the server), but that is very doable in Angular/Angular2.

Whatever the client, the server needs not to trust it in the slightest. That mitigates most issues right there. Because the client lives in enemy territory, it just isn't the real point of control for anything (except, of course, for display and talking to the user - hence the need for XSS/CSRF protections there)

Improve this answer
4

The browser should be trusted with the user's data in any case. Whether you use a single-page app or a plain HTML page, you are toast if the browser is compromised. Single-page apps do not change anything in this context.

Single-page apps can however extend the potential of a server-side vulnerability - since you're now offloading some of the processing to the client you may sometimes forget to properly validate the incoming data server-side, or send data the client isn't supposed to see, relying on the client-side app to hide it (a malicious attacker would modify the client to not hide such data).

In terms of any properly developed app, it should be well-tested and audited in any case so that any mistakes would be caught before going live.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.