One of my colleagues suggested the following methods to secure against XSS attacks in my angular5 application:
Enable
X-XSS-Protection
headerEnable
X-frame-options
headerAdding proper content security policy to prevent inline javascript execution.
But I don't think the above protect my application from all XSS attacks. Do I need to anything more than the above?
NOTE
I am planning to pass auth token to the backend API via authorization
header. In order to do that, I need to store the token either in local storage or in a cookie (access to ready by javascript).