XSS prevention in single page web applications

Question

One of my colleagues suggested the following methods to secure against XSS attacks in my angular5 application:

1. Enable X-XSS-Protection header

2. Enable X-frame-options header

3. Adding proper content security policy to prevent inline javascript execution.

But I don't think the above protect my application from all XSS attacks. Do I need to anything more than the above?

NOTE

I am planning to pass auth token to the backend API via authorization header. In order to do that, I need to store the token either in local storage or in a cookie (access to ready by javascript).

Answer 1

But I don't think the above protect my application from all XSS attacks. Do I need to anything more than the above?

These headers will not magically protect you from all XSS attacks. X-XSS-Protection only lets you tune what the browser does if its heuristics detect a potential XSS (reflected XSS only). And X-Frame-Options is not about XSS at all but about preventing Clickjacking.

As long as your application needs Javascript there is simply no magic header which will prevent XSS. You can limit the impact of potential XSS with a strict Content-Security-Policy but other then that you just need to have proper coding, validating and sanitizing all input etc. See OWASP: XSS Prevention Cheat Sheet for more information.