Question 1

How does Angular help prevent XSS?

Accepted Answer

Template binding sanitizes untrusted values; avoid bypassing DomSanitizer except for trusted content. Never build HTML with string concat from user input. Prefer text binding. Audit innerHTML usage.

Question 2

What is CSRF and how do Angular apps mitigate it?

Accepted Answer

Cross-site request forgery tricks the browser into sending auth cookies; use tokens/SameSite and careful cookie design. HttpClientXsrfModule reads cookie tokens for mutating requests. Prefer token auth in headers for SPAs when appropriate.

Question 3

Why is bypassSecurityTrustHtml dangerous?

Accepted Answer

It disables sanitization—malicious HTML/JS can execute if content isn't fully trusted. Only use for content you control end-to-end. Prefer sanitizing markdown pipelines.

Question 4

Security checklist for an Angular enterprise app?

Accepted Answer

Sanitize HTML, secure tokens/storage, HTTPS, CSP, dependency audits, least-privilege API scopes, no secrets in bundles. Treat XSS/CSRF/open redirects seriously. Review interceptors handling auth. Train team on DomSanitizer misuse.

Security Angular Interview Questions

Other Angular interview topics