I'm looking into Angular and read that typescript is compiled to javascript. Is everything viewable/visible to users that I write using typescript? With PHP I know you run code that's only visible to the server. Does Angular also have code visible only to the server or is everything visible to everyone?

There is a reason I'm asking this and let me create a simple scenario where I find this information relevant:

You have server A which publishes REST services. Server A only allows server B to access it (ip whitelist and such). Server B calls REST services from server A. These REST calls are unsecured and do not require authentication because only server B can call those rest services.

  1. Can a user see the rest calls the Angular website makes?
  2. If yes, can a user abuse these unsecured REST calls somehow?
  • I suspect you may be confused about some important details. You mention that Server A only accepts requests from Server B. However, Angular is a frontend framework - it wouldn't be running on Server B. It would be running in a user's browser. It's possible that Server B is hosting the Angular application, but in that case the requests still don't come from Server B - they come from the browser of the user who visited Server B. Commented Feb 21, 2020 at 13:12
  • So if your angular app is hosted by server B as example.com and Server A has the backend API endpoints on api.example.com, then a user who visits example.com will have the angular application returned and it will run in their browser. Therefore any requests the angular app makes will come from the user's IP address (not server B), and will be blocked by your proposed firewall rule. Therefore, your angular app will not work. Commented Feb 21, 2020 at 13:14
  • Thanks for the clarification, that gave me alot of insight! Commented Feb 26, 2020 at 8:52

2 Answers 2


Can a user see the rest calls the Angular website makes?

Short Answer? Yes.

You can go to any webpage, think google or Facebook, for example, open developer tools and the network tab and see what calls are being made, where and what is data being sent.

If yes, can a user abuse these unsecured REST calls somehow?

Absolutely, You shouldn't trust any server, even those within your network.

You should read Zero Trust Security

The philosophy behind a zero trust network assumes that there are attackers both within and outside of the network, so no users or machines should be automatically trusted.

Some Platforms (Like AWS) Have structures like this:

Your Application <=> Public API (Authorization) <=> Internal Network

As a side note, I would consider using a more secure platform for data transfer, most companies I have been in use JWT


Unlike PHP, Angular is a frontend framework. All frontend code is visible to the end user.

All network calls are also visible to the end user, even if it's encrypted with HTTPS. Encryption will only protect against man-in-the-middle attacks. An IP whitelist will not.

Although only a whitelisted IP can successfully receive data back from the REST service, any unencrypted data is susceptible to being read and modified by anyone snooping on the network between the client and the server.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .