Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [angularjs]

Angular JS is a JavaScript framework for developing the client side of single page webapplications.

0
votes
1answer
104 views

Application design to avoid XSS & CSRF attacks

I am learning to design a system where it can be guarded against XSS & CSRF attack. I'll quickly list down my understanding and then raise questions. It's a simple case of fraud that I am trying ...
0
votes
0answers
42 views

How do I protect my BE endpoints from FE?

Is there any way to secure the endpoints from frontend? I have an API written in NodeJs and I have a frontend website written in AngularJS and app in ionic. I had jwt token from the backend to ...
1
vote
0answers
111 views

Angular JS alternative xss payload?

Basically, I have a situation right now where the registration website allow to register via email address and then redirects me to another website (subdomain) of the original website. The subdomain ...
0
votes
1answer
77 views

Angular application for PCI-DSS certification

I want to design Angular 6 application for PCI-DSS compliance. Is it a good idea to use it having in mind that this is a client-side application with a server back-end? Do you know if there any ...
0
votes
1answer
95 views

empty angular application has some ad links in the source code

I've started to learn angular and I've just followed some tutorials. I've created my application using the command: ng new my-first-app and then I've started it using: ng serve After my ...
0
votes
0answers
92 views

Older Angular - 1.2.32 - Payload to XSS

Testing the app with older Angular. Somehow curly brackets are removed when entered in the field, or as parameter. Found this payload list: https://gist.github.com/mccabe615/...
2
votes
2answers
465 views

Use javascript variable instead of session cookie

I have decided to plunge deep into Angular-like technologies, where all pages are practically just one page that gets never reloaded. And at this point I had the idea, instead of using cookies (which ...
2
votes
0answers
868 views

Protecting frontend code for SPA + Restful API with OIDC

I've got an Angular 1 SPA with a Restful API that I'd like to restrict access to. As I understand, typically the OIDC Implicit flow is designed just for this. However, I consider the frontend SPA code ...
2
votes
1answer
729 views

AngularJS Sanitize function vs. server-side output encoding

I mainly audit web applications and provide the companies with security countermeasures and recommendations. Currently, I have an issue with giving a correct recommendation when it comes to AngularJS ...
0
votes
2answers
2k views

What are the best practices to secure an Angular & Spring web project?

I'm creating WEB project in Angular4 and Spring. This is educational project for my learning. I want to encrypt some data in Angular and then store it in backend. Idea is to not have any acces to ...
25
votes
3answers
20k views

Do I need CSRF token if I'm using Bearer JWT?

Context: Angular site is hosted on S3 behind CloudFront, separate from Express server that is used as API and almost all requests are XMLHttpRequests. All requests are sent without cookies (...
0
votes
2answers
601 views

Is inserting url parameters directly into the page safe in angular 2+?

So the other day at work I noticed this code in one of our web apps: this.activatedRoute.params.subscribe(params => { this.a = params['b']; }); and then in the HTML: {{a}} So basically if I ...
-4
votes
1answer
5k views

Get MAC address of client using PHP, Angular js, jQuery/JavaScript [closed]

ipAddress=$_SERVER['REMOTE_ADDR']; $macAddr=false; #run the external command, break output into lines $arp=`arp -a $ipAddress`; $lines=explode("\n", $arp); #look for the output line describing our ...
0
votes
2answers
3k views

How secure is Angular? [closed]

Very simple question - Is angular a secure option for enterprise development? - Is it Angular 2/4 a valid alternative to .net MVC? - Is there any special security process or recommendation for ...
4
votes
0answers
66 views

What are commonly used security practices when writing a hybrid mobile app with a framework like ionic 2?

I'm new to hybrid app development and web development in general. Are there common coding practices/techniques I can use to ensure that I write code which does not put the end user at risk of ...
-1
votes
1answer
12k views

How to get client MAC address using Angular JS? [closed]

I want to find the client MAC address using Angular JS or JavaScript. How can I do that?
2
votes
1answer
833 views

CSRF tokens for a JWT-auth system using cookies

I think I have this sorted, but would love to hear if I'm wrong. We have a Python+Angular.js set of apps, which are using JWT tokens for authentication, where the tokens are encrypted using a secret ...
0
votes
1answer
4k views

What is best way to pentest an AngularJS web app with a REST backend?

Traditionall webapps are often pentested by vulnerability scanners like Burp Suite, OWASP ZAP or with the other gazillion tools included in Kali. But what is the best way to pentest automatically a ...
1
vote
2answers
622 views

JavaScript resource files are available without authentication - is this a security risk?

I am testing an application and come across few javascript pages that are publicly accessible. I have earlier also found few websites which allows .js pages public access. So as per me this can be ...
1
vote
1answer
2k views

Determine a Web Application's version of AngularJS

For reconnaissance, is there a definitive way to determine the version of AngularJS that a web application uses. Other tools, such as wappalyzer and builtwith show the frameworks, but not the version....
2
votes
1answer
373 views

Is there any point in using 'strict-dynamic' in an AngularJS 1.x application?

I do not see the point in using CSP 3's new strict-dynamic in the case of an AngularJS 1.x application. As far as I can tell, using strict-dynamic still allows arbitrary Javascript injection via a ...
1
vote
2answers
926 views

High security application in Angular - a bad idea?

Well this is not a question of a specific problem I have it's more a general question. Yesterday I had a little argument with a friend of mine wehter or not a "high security application" (e-Banking ...
-4
votes
1answer
65 views

Secuirty related certification/training for .NET Developers [closed]

I would like to know if there are any Free certifications related to writing secure code that myself and our team of .NET/AngularJS web-developers take up, So that we can write secure code and also ...
2
votes
0answers
171 views

Is it possible to use Burp to show hidden AngularJS elements, that are hidden using “ngHide”?

I’m performing an audit of an AngularJS application that uses Angular's ngShow and ngHide to show and hide elements on a page. Is it possible to use Burp Proxy, Burp Macros, or another tool to ...
2
votes
1answer
419 views

How to securely access web api from Html5 Website

So the thing is I have created a Asp.Net web api and am using oauth to secure the access. The problem is that the clients want to make a pure html(angular) website from which they will access the api. ...
17
votes
1answer
6k views

Vulnerability in popular Javascript Framework (Angularjs)

I found a bug that allows you to escape the AngularJS template sandbox. Angular is a mustache based template language. It allows you to put expressions that are evaluated in your html. For example, {{...
1
vote
2answers
2k views

Access to raw html source code after angular client side processing

I need help to check if parameters are sensitive to XSS injections in a webpage generated by angularjs. Today, many websites are using angularjs in order to deport client page construction at the ...
2
votes
0answers
426 views

Angular XSS not evaluated

Using an older version of AngularJS : 1.2.21 from example, there are some playload that can generate an XSS. {{toString.constructor.prototype.toString=toString.constructor.prototype.call;["a","alert(...
1
vote
2answers
567 views

How secure is keeping a token in angular for future requests to a Laravel API?

I have an Angular JS Front end which consumes Web Services from an API developed using Laravel 5. BACKGROUND INFORMATION 1 When the user logs in, if it's successful the API returns a token and the ...
6
votes
1answer
10k views

How to pentest an AngularJS based SPA (Single Page Application)

I am trying to Pentest an application which is built in AngularJS. The difficulties that I am facing: Burp Suite's "spider this host" option is not able to crawl all the urls as most of the requests ...
2
votes
8answers
6k views

How to avoid reveal password in a form?

I've recently discover that if you use inspect element to see the source code of the Html, you can change this <input type="password"/> to <input type="text"/> then you can see the ...
1
vote
1answer
2k views

Vulnerability scanning of AngularJS web app fails due to '#' in url

I tried scanning my web application built with AngularJS front-end and PHP backend. But scanning with scanners like Nessus and Websecurify fails due to '#' in URL. My URL has format http://domain....