Very simple question - Is angular a secure option for enterprise development? - Is it Angular 2/4 a valid alternative to .net MVC? - Is there any special security process or recommendation for these environments?
5
-
21) AngularJS cannot be an alternative to C#: they are not used for the same purposes. You should start by reading their Wikipedia pages. This question would be best suited for stackoverflow. 2) Your security question is far too broad to be answered here. You can start by reading OWASP's guides.– A. HerseanFeb 28, 2017 at 9:36
-
Update to my previous comment since you changed your question, and now have 3 questions: Firstly, you should ask 3 separate questions. This way you will have better answers. Secondly, your question comparing Angular JS to .net MVC is not related to information security and should be posted on stackoverflow.– A. HerseanFeb 28, 2017 at 9:53
-
@A.Hersean, I've post there and it was vote fore remove. Thanks anyway. BTW I'm talking about Angular (Angular2/Angular4) not AngularJS– FrozenButcherFeb 28, 2017 at 9:56
-
1@A.Hersean Unfortunately, that question is not a good fit for Stack Overflow. Questions asking to compare product A to product B will be closed as Primarily Opinion Based there. And most of the time, rightfully so.– S.L. BarthFeb 28, 2017 at 11:24
-
@s-l-barth This question would be opinion based here too. At least on Stack Overflow it's on topic.– A. HerseanFeb 28, 2017 at 13:18
Add a comment
|
2 Answers
It sounds like you're mixing scopes a bit. Angular is a front-end technology, and while you can escape HTML to prevent XSS attacks, any basic templating language can handle that.
When you think about security in a web app, you have to remember that the end user is free to run whatever code they want on the front end, and they can hit your APIs in custom ways you didn't intend. In that sense, the real concern is really around your backend tech and how consciously your app's APIs are written. The front end isn't nearly as large of a concern because the user can do whatever they want anyway.
If I can try to interpret the question to answer 'I suspect that you can reach an adequate security with Angular if you know what you are doing, yet many of the issues with Angular that you could have to watch out for is more or less built-in and fixed if you use .NET alternatives such as MVC.'.
And yes, its not a fair comparison. Server-side and client-side etc. I have heard those comment that one should use Angular to complement .NET MVC. But from a security perspektive .. complicated = vulnerable.
