Questions tagged [angularjs]
AngularJS is a JavaScript framework for developing the client side of single page web applications. Use this tag for all versions of the framework.
42
questions
0
votes
0
answers
12
views
Are there specific cybersecurity things to be aware of before creating a forum site or message board using Google firebase? [closed]
I am an entrepeneur who hires developers on fiverr or upwork to maintain and develop my MVP website (built using Angular).
I want the website to develop into a forum/message board. However I want to ...
0
votes
1
answer
55
views
Exploit user controllable C# code in webapp
The application in question offers the option to create arbitrary C# code and execute it at any time. These could be considered macros to customize certain tasks. Say that a normal user, who would ...
- 3
0
votes
0
answers
65
views
Dealing with CVE-2022-2584 in Angular JS
The package angular after 1.7.0 is vulnerable to Regular Expression Denial of Service (ReDoS). There aren't many details available around this issue. Since this version of Angular is out of support, I'...
- 101
0
votes
0
answers
39
views
JavaScript API calls in Browser security
We want to develop a JavaScript application (with Angular) which will communicate with various other systems via API calls. For example, a checkout page where all entered information should be sent to ...
- 1
3
votes
2
answers
1k
views
Cookie-to-header token CSRF protection - is it necessary to verify cookie value?
I'm testing Angular application which uses Cookie-to-header token CSRF protection. According to Angular documentation https://angular.io/guide/http#security-xsrf-protection:
When performing HTTP ...
- 1,233
0
votes
2
answers
1k
views
Cookie-to-header token CSRF protection
I have the Angular application where CSRF protection is implemented using Cookie-to-header token. It is default AngularJS mechanism to counter CSRF, which uses cookie XSRF-TOKEN and header X-XSRF-...
- 1,233
1
vote
1
answer
974
views
Am I handling JWT token correctly?
The app is divided into two parts, the fronted - written with the Angular framework and the backend, simple PHP files which handle the login, API calls, etc.
My current flow is the following:
User ...
- 13
4
votes
1
answer
332
views
Mitigation for Insecure Deserialization
I'm trying to look for some way for mitigation of insecure deserialization vulnerability for the application front-end
Then I found this link
https://blog.jscrambler.com/exploring-the-owasp-top-10-by-...
aj go
2
votes
1
answer
202
views
I discovered a Client Side Template Injection (CSTI), and after?
As part of a bounty bug, I discovered a Client Side Template Injection (CSTI). I would like to create more "impressive" payload to increase the risk of the vulnerability. The framework ...
- 274
1
vote
0
answers
254
views
Securing API keys for accessing Google APIs via Front End (UI)
This question is about how to secure API keys. Not sure if this is in the same category as Key management for Cryptography and should follow the same rules. See details below.
We currently have hybrid ...
0
votes
0
answers
379
views
How to evade Angular HTML sanitizer for XSS
I'm trying to evade the HTML sanitizer in a field I found more vulnerable in my application to test some XSS injection.
The field that I'm trying to exploit is a dropdown with the following code. The ...
- 101
1
vote
1
answer
2k
views
How to properly invalidate JWT tokens and sessions in this use case?
I am building a web app, which is made of a Node.js Backend and Angular (NOT AngularJS!!! I only used the tag, because Angular was not available..) Frontend.
How do I properly secure this app? I ...
- 234
0
votes
1
answer
228
views
Application design to avoid XSS & CSRF attacks
I am learning to design a system where it can be guarded against XSS & CSRF attack. I'll quickly list down my understanding and then raise questions. It's a simple case of fraud that I am trying ...
1
vote
0
answers
516
views
Angular JS alternative xss payload?
Basically, I have a situation right now where the registration website allow to register via email address and then redirects me to another website (subdomain) of the original website. The subdomain ...
- 11
3
votes
2
answers
734
views
Angular application for PCI-DSS certification
I want to design Angular 6 application for PCI-DSS compliance. Is it a good idea to use it having in mind that this is a client-side application with a server back-end? Do you know if there any ...
- 141
0
votes
1
answer
193
views
empty angular application has some ad links in the source code
I've started to learn angular and I've just followed some tutorials. I've created my application using the command:
ng new my-first-app
and then I've started it using:
ng serve
After my ...
- 265
3
votes
2
answers
1k
views
Use javascript variable instead of session cookie
I have decided to plunge deep into Angular-like technologies, where all pages are practically just one page that gets never reloaded. And at this point I had the idea, instead of using cookies (which ...
- 133
2
votes
0
answers
1k
views
Protecting frontend code for SPA + Restful API with OIDC
I've got an Angular 1 SPA with a Restful API that I'd like to restrict access to. As I understand, typically the OIDC Implicit flow is designed just for this. However, I consider the frontend SPA code ...
- 21
2
votes
1
answer
2k
views
AngularJS Sanitize function vs. server-side output encoding
I mainly audit web applications and provide the companies with security countermeasures and recommendations. Currently, I have an issue with giving a correct recommendation when it comes to AngularJS ...
- 129
0
votes
2
answers
5k
views
What are the best practices to secure an Angular & Spring web project?
I'm creating WEB project in Angular4 and Spring. This is educational project for my learning.
I want to encrypt some data in Angular and then store it in backend. Idea is to not have any acces to ...
112
votes
4
answers
95k
views
Do I need CSRF token if I'm using Bearer JWT?
Context: Angular site is hosted on S3 behind CloudFront, separate from Express server that is used as API and almost all requests are XMLHttpRequests. All requests are sent without cookies (...
- 1,223
0
votes
2
answers
2k
views
Is inserting url parameters directly into the page safe in angular 2+?
So the other day at work I noticed this code in one of our web apps:
this.activatedRoute.params.subscribe(params => {
this.a = params['b'];
});
and then in the HTML:
{{a}}
So basically if I ...
- 309
-4
votes
1
answer
8k
views
Get MAC address of client using PHP, Angular js, jQuery/JavaScript [closed]
ipAddress=$_SERVER['REMOTE_ADDR'];
$macAddr=false;
#run the external command, break output into lines
$arp=`arp -a $ipAddress`;
$lines=explode("\n", $arp);
#look for the output line describing our ...
- 1
1
vote
2
answers
5k
views
How secure is Angular? [closed]
Very simple question
- Is angular a secure option for enterprise development?
- Is it Angular 2/4 a valid alternative to .net MVC?
- Is there any special security process or recommendation for ...
- 121
4
votes
0
answers
116
views
What are commonly used security practices when writing a hybrid mobile app with a framework like ionic 2?
I'm new to hybrid app development and web development in general. Are there common coding practices/techniques I can use to ensure that I write code which does not put the end user at risk of ...
- 141
1
vote
1
answer
17k
views
How to get client MAC address using Angular JS? [closed]
I want to find the client MAC address using Angular JS or JavaScript. How can I do that?
- 127
3
votes
1
answer
1k
views
CSRF tokens for a JWT-auth system using cookies
I think I have this sorted, but would love to hear if I'm wrong. We have a Python+Angular.js set of apps, which are using JWT tokens for authentication, where the tokens are encrypted using a secret ...
- 392
3
votes
1
answer
10k
views
What is best way to pentest an AngularJS web app with a REST backend?
Traditionall webapps are often pentested by vulnerability scanners like Burp Suite, OWASP ZAP or with the other gazillion tools included in Kali.
But what is the best way to pentest automatically a ...
- 41
1
vote
2
answers
2k
views
JavaScript resource files are available without authentication - is this a security risk?
I am testing an application and come across few javascript pages that are publicly accessible. I have earlier also found few websites which allows .js pages public access.
So as per me this can be ...
- 189
1
vote
1
answer
3k
views
Determine a Web Application's version of AngularJS
For reconnaissance, is there a definitive way to determine the version of AngularJS that a web application uses.
Other tools, such as wappalyzer and builtwith show the frameworks, but not the version....
- 51
2
votes
1
answer
534
views
Is there any point in using 'strict-dynamic' in an AngularJS 1.x application?
I do not see the point in using CSP 3's new strict-dynamic in the case of an AngularJS 1.x application.
As far as I can tell, using strict-dynamic still allows arbitrary Javascript injection via a ...
- 186
1
vote
2
answers
1k
views
High security application in Angular - a bad idea?
Well this is not a question of a specific problem I have it's more a general question.
Yesterday I had a little argument with a friend of mine wehter or not a "high security application" (e-Banking ...
- 255
-3
votes
1
answer
104
views
Secuirty related certification/training for .NET Developers [closed]
I would like to know if there are any Free certifications related to writing secure code that myself and our team of .NET/AngularJS web-developers take up,
So that we can write secure code and also ...
- 95
2
votes
0
answers
277
views
Is it possible to use Burp to show hidden AngularJS elements, that are hidden using "ngHide"?
I’m performing an audit of an AngularJS application that uses Angular's ngShow and ngHide to show and hide elements on a page. Is it possible to use Burp Proxy, Burp Macros, or another tool to ...
- 21
2
votes
1
answer
529
views
How to securely access web api from Html5 Website
So the thing is I have created a Asp.Net web api and am using oauth to secure the access.
The problem is that the clients want to make a pure html(angular) website from which they will access the api. ...
- 121
17
votes
1
answer
6k
views
Vulnerability in popular Javascript Framework (Angularjs)
I found a bug that allows you to escape the AngularJS template sandbox. Angular is a mustache based template language. It allows you to put expressions that are evaluated in your html. For example, {{...
- 311
1
vote
2
answers
5k
views
Access to raw html source code after angular client side processing
I need help to check if parameters are sensitive to XSS injections in a webpage generated by angularjs.
Today, many websites are using angularjs in order to deport client page construction at the ...
- 1,348
2
votes
0
answers
540
views
Angular XSS not evaluated
Using an older version of AngularJS : 1.2.21 from example, there are some playload that can generate an XSS.
{{toString.constructor.prototype.toString=toString.constructor.prototype.call;["a","alert(...
- 290
2
votes
2
answers
814
views
How secure is keeping a token in angular for future requests to a Laravel API?
I have an Angular JS Front end which consumes Web Services from an API developed using Laravel 5.
BACKGROUND INFORMATION 1
When the user logs in, if it's successful the API returns a token and the ...
- 123
12
votes
2
answers
15k
views
How to pentest an AngularJS based SPA (Single Page Application)
I am trying to Pentest an application which is built in AngularJS. The difficulties that I am facing:
Burp Suite's "spider this host" option is not able to crawl all the urls as most of the requests ...
- 399
3
votes
8
answers
11k
views
How to avoid reveal password in a form?
I've recently discover that if you use inspect element to see the source code of the Html, you can change this <input type="password"/> to <input type="text"/> then you can see the ...
- 195
1
vote
1
answer
2k
views
Vulnerability scanning of AngularJS web app fails due to '#' in url
I tried scanning my web application built with AngularJS front-end and PHP backend. But scanning with scanners like Nessus and Websecurify fails due to '#' in URL. My URL has format
http://domain....
- 452