0

Very simple question - Is angular a secure option for enterprise development? - Is it Angular 2/4 a valid alternative to .net MVC? - Is there any special security process or recommendation for these environments?

closed as too broad by Anders, Serge Ballesta, Matthew, S.L. Barth, Steve Feb 28 '17 at 14:52

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    1) AngularJS cannot be an alternative to C#: they are not used for the same purposes. You should start by reading their Wikipedia pages. This question would be best suited for stackoverflow. 2) Your security question is far too broad to be answered here. You can start by reading OWASP's guides. – A. Hersean Feb 28 '17 at 9:36
  • Update to my previous comment since you changed your question, and now have 3 questions: Firstly, you should ask 3 separate questions. This way you will have better answers. Secondly, your question comparing Angular JS to .net MVC is not related to information security and should be posted on stackoverflow. – A. Hersean Feb 28 '17 at 9:53
  • @A.Hersean, I've post there and it was vote fore remove. Thanks anyway. BTW I'm talking about Angular (Angular2/Angular4) not AngularJS – FrozenButcher Feb 28 '17 at 9:56
  • 1
    @A.Hersean Unfortunately, that question is not a good fit for Stack Overflow. Questions asking to compare product A to product B will be closed as Primarily Opinion Based there. And most of the time, rightfully so. – S.L. Barth Feb 28 '17 at 11:24
  • @s-l-barth This question would be opinion based here too. At least on Stack Overflow it's on topic. – A. Hersean Feb 28 '17 at 13:18
1

If I can try to interpret the question to answer 'I suspect that you can reach an adequate security with Angular if you know what you are doing, yet many of the issues with Angular that you could have to watch out for is more or less built-in and fixed if you use .NET alternatives such as MVC.'.

And yes, its not a fair comparison. Server-side and client-side etc. I have heard those comment that one should use Angular to complement .NET MVC. But from a security perspektive .. complicated = vulnerable.

1

It sounds like you're mixing scopes a bit. Angular is a front-end technology, and while you can escape HTML to prevent XSS attacks, any basic templating language can handle that.

When you think about security in a web app, you have to remember that the end user is free to run whatever code they want on the front end, and they can hit your APIs in custom ways you didn't intend. In that sense, the real concern is really around your backend tech and how consciously your app's APIs are written. The front end isn't nearly as large of a concern because the user can do whatever they want anyway.

Not the answer you're looking for? Browse other questions tagged or ask your own question.