[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-572073-105":53,"doc-detail-572073-en":127},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":120,"head_meta":122,"extra_data":124,"updated_unix":126},105,"en","angular-and-the-owasp-top-10-security-cheat-sheet-version-2020001","Angular and the OWASP top 10 - Security Cheat Sheet - Version 2020.001","","Security Cheat Sheet Version 2020.001 provides an opinionated, frontend-focused interpretation of the OWASP Top 10 (2017) for Angular applications. It concentrates on the most relevant vulnerabilities and gives practical guidance for mitigating them, while explicitly excluding many backend-specific issues that belong on the API side. The sheet covers areas such as dependency vulnerability management, broken authentication, cross-site scripting, broken access control, and sensitive data exposure.",{"@graph":63,"@context":119},[64,80,102],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/angular-and-the-owasp-top-10-security-cheat-sheet-version-2020001/572073/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/angular-and-the-owasp-top-10-security-cheat-sheet-version-2020001/572073.png","ImageObject",442,249,{"name":88,"@type":89},"Fans","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-22","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":101},"InteractionCounter",{"@type":100},"ViewAction",6,{"@type":103,"mainEntity":104},"FAQPage",[105,111,115],{"name":106,"@type":107,"acceptedAnswer":108},"What scope does this cheat sheet cover for OWASP Top 10 in Angular?","Question",{"text":109,"@type":110},"It targets a frontend Angular application and focuses on vulnerabilities most relevant to the frontend. Backend-related API issues are explicitly out of scope and omitted.","Answer",{"name":112,"@type":107,"acceptedAnswer":113},"How does the sheet recommend handling dependencies with known vulnerabilities?",{"text":114,"@type":110},"It recommends planning a periodic release schedule, using npm audit, setting up automated dependency checks, leveraging GitHub dependency checking, and integrating checks into the build pipeline.",{"name":116,"@type":107,"acceptedAnswer":117},"What measures are suggested to reduce broken authentication risks?",{"text":118,"@type":110},"It emphasizes maintaining authentication state correctly (stateless vs server-side state), using strong session identifiers or protected state signatures, verifying inbound state integrity on the backend, managing signing key rotation, and applying proper cookie security attributes plus CSRF protections.","https://schema.org",{"og:url":78,"og:type":121,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":123,"canonical":78},"index,follow",{"doc_id":125,"site_id":56},572073,1792188368,{"code":4,"msg":5,"data":128},{"doc_id":125,"user_id":129,"nickname":88,"user_avatar":130,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":101,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":9,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":4},5909892330395,"https://ap-avatar.wpscdn.com/davatar_6f874abed73319feea01a86fa6f0fab8","Security Cheat Sheet  \nVersion 2020.001  \nAngular and the OWASP top 10  \nThe OWASP top 10 is one of the most influential security documents of all time. But how do these top 10 vulnerabilities resonate in a frontend JavaScript application?  \nThis cheat sheet offers practical advice on handling the most relevant OWASP top 10 vulnerabilities in Angular applications.  \nDISCLAIMER This is an opinionated interpretation of the OWASP top 10 (2017), applied to frontend Angular applications. Many backend-related issues apply to the API-side of an Angular application (e. g., SQL injection), but are out of scope for this cheat sheet. Hence, they are omitted.  \n1 Using dependencies with known vulnerabilities   \nOWASP \\#9  \n Plan for a periodical release schedule  \n Use npm audit to scan for known vulnerabilities  \n Setup automated dependency checking to receive alerts  \nGithub offers automatic dependency checking as a free service  \n Integrate dependency checking into your build pipeline  \n2 Broken authentication   \nOWASP \\#2  \nFrom an Angular perspective, the most important aspect of broken authentication is maintaining state after authentication. Many alternatives exist, each with their specific security considerations.  \n Decide if a stateless backend is a requirement  \nServer-side state is more secure, and works well in most cases  \nServer-side session state  \n Use long and random session identifiers with high entropy  \nOWASP has a great cheat sheet offering practical advice [1]  \nClient-side session state  \n Use signatures to protect the integrity of the session state  \n Adopt the proper signature scheme for your deployment  \nHMAC-based signatures only work within a single application Public/private key signatures work well in distributed scenarios  \n Verify the integrity of inbound state data on the backend  \nExplicitly avoid the use of “decode-only” functions in libraries  \n Setup key management / key rotation for your signing keys  \n Ensure you can handle session expiration and revocation  \nCookie-based session state transport  \n Enable the proper cookie security properties  \nSet the [HttpOnly](HttpOnly and Secure cookie attributes)[ and](HttpOnly and Secure cookie attributes)[ Secure](HttpOnly and Secure cookie attributes)[ cookie attributes](HttpOnly and Secure cookie attributes)  \n[Add the](Add the__Secure or __Host-prefix on the cookie name)[__Secure](Add the__Secure or __Host-prefix on the cookie name)[ or](Add the__Secure or __Host-prefix on the cookie name)[ __Host-](Add the__Secure or __Host-prefix on the cookie name)[prefix on the cookie name](Add the__Secure or __Host-prefix on the cookie name)  \n Protect the backend against Cross-Site Request Forgery  \nSame-origin APIs should use a double submit cookie  \nCross-Origin APIs should force the use of CORS preflights by only accepting a non-form-based content type (e.g. application/json)  \nAuthorization header-based session state transport  \n Only send the authorization header to pre-approved hosts  \nMany custom interceptors send the header to every host  \n[1] [https://bit.ly/2U8kJWc](https://bit.ly/2U8kJWc)  \n3 Cross-Site Scripting   \nOWASP \\#7  \nPreventing html/script injection in Angular  \n Use interpolation with {{}} to automatically apply escaping  \n Use safe property binding such as [href],[src],[style.color]  \n Use binding to [innerHTML] to safely insert HTML data  \n Do not use bypassSecurityTrust*() on untrusted data  \nPreventing code injection outside of Angular  \n Avoid direct DOM manipulation  \nE.g. through ElementRef or other client-side libraries  \n Do not combine Angular with server-side dynamic pages  \n Use Ahead-Of-Time compilation (AOT)  \n4 Broken access control   \nOWASP \\#5  \nAuthorization checks  \n Implement proper authorization checks on API endpoints  \nCheck if the user is authenticated  \nCheck if the user is allowed to access the specific resources  \n Do not rely on client-side authorization checks for security  \nCross-Origin Resource Sharing (CORS)  \n P","cbCaifgCvNVA1qXZ","https://ap.wps.com/l/cbCaifgCvNVA1qXZ","pdf",216708,"English","# 1 Using dependencies with known vulnerabilities\n# 2 Broken authentication\n# 3 Cross-Site Scripting\n# 4 Broken access control\n# 5 Sensitive data exposure","[{\"question\":\"What scope does this cheat sheet cover for OWASP Top 10 in Angular?\",\"answer\":\"It targets a frontend Angular application and focuses on vulnerabilities most relevant to the frontend. Backend-related API issues are explicitly out of scope and omitted.\"},{\"question\":\"How does the sheet recommend handling dependencies with known vulnerabilities?\",\"answer\":\"It recommends planning a periodic release schedule, using npm audit, setting up automated dependency checks, leveraging GitHub dependency checking, and integrating checks into the build pipeline.\"},{\"question\":\"What measures are suggested to reduce broken authentication risks?\",\"answer\":\"It emphasizes maintaining authentication state correctly (stateless vs server-side state), using strong session identifiers or protected state signatures, verifying inbound state integrity on the backend, managing signing key rotation, and applying proper cookie security attributes plus CSRF protections.\"}]","Angular and the OWASP top 10 - Security Cheat Sheet - Version 2020.001 | PDF",1791925338]