Very simple question - Is angular a secure option for enterprise development? - Is it Angular 2/4 a valid alternative to .net MVC? - Is there any special security process or recommendation for these environments?
closed as too broad by Anders, Serge Ballesta, Matthew, S.L. Barth, Steve Feb 28 '17 at 14:52
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
If I can try to interpret the question to answer 'I suspect that you can reach an adequate security with Angular if you know what you are doing, yet many of the issues with Angular that you could have to watch out for is more or less built-in and fixed if you use .NET alternatives such as MVC.'.
And yes, its not a fair comparison. Server-side and client-side etc. I have heard those comment that one should use Angular to complement .NET MVC. But from a security perspektive .. complicated = vulnerable.
It sounds like you're mixing scopes a bit. Angular is a front-end technology, and while you can escape HTML to prevent XSS attacks, any basic templating language can handle that.
When you think about security in a web app, you have to remember that the end user is free to run whatever code they want on the front end, and they can hit your APIs in custom ways you didn't intend. In that sense, the real concern is really around your backend tech and how consciously your app's APIs are written. The front end isn't nearly as large of a concern because the user can do whatever they want anyway.