Questions tagged [angularjs]
AngularJS is a JavaScript framework for developing the client side of single page web applications. Use this tag for all versions of the framework.
43
questions
0
votes
1
answer
176
views
Is JSON vulnerability still possible?
I have a bunch of REST APIs which would be consumed by frontend applications created by customers using our product. I have suggested to only use last 2 versions of Chrome for running frontend apps. ...
- 101
2
votes
0
answers
42
views
Security in Angular: Addressing XSS Concerns with External Libraries and Interpolation
Introduction:
We heavily use external libraries, such as DataTables, in combination with interpolation. In Angular, we've identified two primary XSS prevention strategies:
Interpolation ({{ }})
...
- 31
0
votes
0
answers
75
views
Progressive profiling with auth0: Security when communicating with auth0 actions
I currently try to implement progressive profiling with auth0 according to: https://auth0.com/blog/using-redirect-with-actions-to-gather-user-info-and-increase-conversions/ to gather first name and ...
- 101
0
votes
0
answers
84
views
Path-Based Vulnerability on security report on images
We are running Qualys security tests on our angular webapp, and we are getting one issue. Whatever images we are loading in the screens, we are getting "Path-Based Vulnerability" issue for ...
0
votes
1
answer
162
views
Exploit user controllable C# code in webapp
The application in question offers the option to create arbitrary C# code and execute it at any time. These could be considered macros to customize certain tasks. Say that a normal user, who would ...
- 3
3
votes
2
answers
3k
views
Cookie-to-header token CSRF protection - is it necessary to verify cookie value?
I'm testing Angular application which uses Cookie-to-header token CSRF protection. According to Angular documentation https://angular.io/guide/http#security-xsrf-protection:
When performing HTTP ...
- 1,293
0
votes
2
answers
2k
views
Cookie-to-header token CSRF protection
I have the Angular application where CSRF protection is implemented using Cookie-to-header token. It is default AngularJS mechanism to counter CSRF, which uses cookie XSRF-TOKEN and header X-XSRF-...
- 1,293
1
vote
1
answer
2k
views
Am I handling JWT token correctly?
The app is divided into two parts, the fronted - written with the Angular framework and the backend, simple PHP files which handle the login, API calls, etc.
My current flow is the following:
User ...
- 13
4
votes
1
answer
395
views
Mitigation for Insecure Deserialization
I'm trying to look for some way for mitigation of insecure deserialization vulnerability for the application front-end
Then I found this link
https://blog.jscrambler.com/exploring-the-owasp-top-10-by-...
aj go
2
votes
1
answer
266
views
I discovered a Client Side Template Injection (CSTI), and after?
As part of a bounty bug, I discovered a Client Side Template Injection (CSTI). I would like to create more "impressive" payload to increase the risk of the vulnerability. The framework ...
- 274
1
vote
0
answers
327
views
Securing API keys for accessing Google APIs via Front End (UI)
This question is about how to secure API keys. Not sure if this is in the same category as Key management for Cryptography and should follow the same rules. See details below.
We currently have hybrid ...
0
votes
0
answers
584
views
How to evade Angular HTML sanitizer for XSS
I'm trying to evade the HTML sanitizer in a field I found more vulnerable in my application to test some XSS injection.
The field that I'm trying to exploit is a dropdown with the following code. The ...
- 101
2
votes
1
answer
3k
views
How to properly invalidate JWT tokens and sessions in this use case?
I am building a web app, which is made of a Node.js Backend and Angular (NOT AngularJS!!! I only used the tag, because Angular was not available..) Frontend.
How do I properly secure this app? I ...
- 244
0
votes
1
answer
233
views
Application design to avoid XSS & CSRF attacks
I am learning to design a system where it can be guarded against XSS & CSRF attack. I'll quickly list down my understanding and then raise questions. It's a simple case of fraud that I am trying ...
1
vote
0
answers
539
views
Angular JS alternative xss payload?
Basically, I have a situation right now where the registration website allow to register via email address and then redirects me to another website (subdomain) of the original website. The subdomain ...
- 11
3
votes
2
answers
841
views
Angular application for PCI-DSS certification
I want to design Angular 6 application for PCI-DSS compliance. Is it a good idea to use it having in mind that this is a client-side application with a server back-end? Do you know if there any ...
- 151
0
votes
1
answer
212
views
empty angular application has some ad links in the source code
I've started to learn angular and I've just followed some tutorials. I've created my application using the command:
ng new my-first-app
and then I've started it using:
ng serve
After my ...
- 265
3
votes
2
answers
2k
views
Use javascript variable instead of session cookie
I have decided to plunge deep into Angular-like technologies, where all pages are practically just one page that gets never reloaded. And at this point I had the idea, instead of using cookies (which ...
- 133
2
votes
0
answers
1k
views
Protecting frontend code for SPA + Restful API with OIDC
I've got an Angular 1 SPA with a Restful API that I'd like to restrict access to. As I understand, typically the OIDC Implicit flow is designed just for this. However, I consider the frontend SPA code ...
- 21
2
votes
1
answer
2k
views
AngularJS Sanitize function vs. server-side output encoding
I mainly audit web applications and provide the companies with security countermeasures and recommendations. Currently, I have an issue with giving a correct recommendation when it comes to AngularJS ...
- 129
0
votes
2
answers
5k
views
What are the best practices to secure an Angular & Spring web project?
I'm creating WEB project in Angular4 and Spring. This is educational project for my learning.
I want to encrypt some data in Angular and then store it in backend. Idea is to not have any acces to ...
126
votes
4
answers
108k
views
Do I need CSRF token if I'm using Bearer JWT?
Context: Angular site is hosted on S3 behind CloudFront, separate from Express server that is used as API and almost all requests are XMLHttpRequests. All requests are sent without cookies (...
- 1,363
0
votes
2
answers
2k
views
Is inserting url parameters directly into the page safe in angular 2+?
So the other day at work I noticed this code in one of our web apps:
this.activatedRoute.params.subscribe(params => {
this.a = params['b'];
});
and then in the HTML:
{{a}}
So basically if I ...
- 319
-4
votes
1
answer
8k
views
Get MAC address of client using PHP, Angular js, jQuery/JavaScript [closed]
ipAddress=$_SERVER['REMOTE_ADDR'];
$macAddr=false;
#run the external command, break output into lines
$arp=`arp -a $ipAddress`;
$lines=explode("\n", $arp);
#look for the output line describing our ...
- 1
1
vote
2
answers
5k
views
How secure is Angular? [closed]
Very simple question
- Is angular a secure option for enterprise development?
- Is it Angular 2/4 a valid alternative to .net MVC?
- Is there any special security process or recommendation for ...
- 121
4
votes
0
answers
120
views
What are commonly used security practices when writing a hybrid mobile app with a framework like ionic 2?
I'm new to hybrid app development and web development in general. Are there common coding practices/techniques I can use to ensure that I write code which does not put the end user at risk of ...
- 141
1
vote
1
answer
18k
views
How to get client MAC address using Angular JS? [closed]
I want to find the client MAC address using Angular JS or JavaScript. How can I do that?
- 127
3
votes
1
answer
1k
views
CSRF tokens for a JWT-auth system using cookies
I think I have this sorted, but would love to hear if I'm wrong. We have a Python+Angular.js set of apps, which are using JWT tokens for authentication, where the tokens are encrypted using a secret ...
- 392
3
votes
1
answer
10k
views
What is best way to pentest an AngularJS web app with a REST backend?
Traditionall webapps are often pentested by vulnerability scanners like Burp Suite, OWASP ZAP or with the other gazillion tools included in Kali.
But what is the best way to pentest automatically a ...
- 41
1
vote
2
answers
2k
views
JavaScript resource files are available without authentication - is this a security risk?
I am testing an application and come across few javascript pages that are publicly accessible. I have earlier also found few websites which allows .js pages public access.
So as per me this can be ...
- 189
1
vote
1
answer
4k
views
Determine a Web Application's version of AngularJS
For reconnaissance, is there a definitive way to determine the version of AngularJS that a web application uses.
Other tools, such as wappalyzer and builtwith show the frameworks, but not the version....
- 51
2
votes
1
answer
557
views
Is there any point in using 'strict-dynamic' in an AngularJS 1.x application?
I do not see the point in using CSP 3's new strict-dynamic in the case of an AngularJS 1.x application.
As far as I can tell, using strict-dynamic still allows arbitrary Javascript injection via a ...
- 186
1
vote
2
answers
1k
views
High security application in Angular - a bad idea?
Well this is not a question of a specific problem I have it's more a general question.
Yesterday I had a little argument with a friend of mine wehter or not a "high security application" (e-Banking ...
- 255
-3
votes
1
answer
113
views
Secuirty related certification/training for .NET Developers [closed]
I would like to know if there are any Free certifications related to writing secure code that myself and our team of .NET/AngularJS web-developers take up,
So that we can write secure code and also ...
- 95
2
votes
0
answers
299
views
Is it possible to use Burp to show hidden AngularJS elements, that are hidden using "ngHide"?
I’m performing an audit of an AngularJS application that uses Angular's ngShow and ngHide to show and hide elements on a page. Is it possible to use Burp Proxy, Burp Macros, or another tool to ...
- 21
2
votes
1
answer
541
views
How to securely access web api from Html5 Website
So the thing is I have created a Asp.Net web api and am using oauth to secure the access.
The problem is that the clients want to make a pure html(angular) website from which they will access the api. ...
- 121
17
votes
1
answer
6k
views
Vulnerability in popular Javascript Framework (Angularjs)
I found a bug that allows you to escape the AngularJS template sandbox. Angular is a mustache based template language. It allows you to put expressions that are evaluated in your html. For example, {{...
- 311
1
vote
2
answers
5k
views
Access to raw html source code after angular client side processing
I need help to check if parameters are sensitive to XSS injections in a webpage generated by angularjs.
Today, many websites are using angularjs in order to deport client page construction at the ...
- 1,328
2
votes
0
answers
561
views
Angular XSS not evaluated
Using an older version of AngularJS : 1.2.21 from example, there are some playload that can generate an XSS.
{{toString.constructor.prototype.toString=toString.constructor.prototype.call;["a","alert(...
- 290
2
votes
2
answers
843
views
How secure is keeping a token in angular for future requests to a Laravel API?
I have an Angular JS Front end which consumes Web Services from an API developed using Laravel 5.
BACKGROUND INFORMATION 1
When the user logs in, if it's successful the API returns a token and the ...
- 123
13
votes
2
answers
16k
views
How to pentest an AngularJS based SPA (Single Page Application)
I am trying to Pentest an application which is built in AngularJS. The difficulties that I am facing:
Burp Suite's "spider this host" option is not able to crawl all the urls as most of the requests ...
- 409
4
votes
8
answers
11k
views
How to avoid reveal password in a form?
I've recently discover that if you use inspect element to see the source code of the Html, you can change this <input type="password"/> to <input type="text"/> then you can see the ...
- 205
1
vote
1
answer
2k
views
Vulnerability scanning of AngularJS web app fails due to '#' in url
I tried scanning my web application built with AngularJS front-end and PHP backend. But scanning with scanners like Nessus and Websecurify fails due to '#' in URL. My URL has format
http://domain....
- 442