Security Interview Questions

XSS attacks inject malicious scripts. Angular prevents by default through automatic sanitization of HTML, style bindings. Use DomSanitizer for trusted content, avoid bypass methods. Implement Content Security Policy (CSP).

Angular includes built-in CSRF/XSRF protection using double-submit cookie pattern. Automatically adds XSRF-TOKEN cookie to requests. Configure through HttpClientXsrfModule. Server must support token validation.

CSP restricts resource loading, prevents attacks. Configure through meta tags or HTTP headers. Affects script execution, style loading, image sources. Consider inline styles/scripts restrictions.

Authentication through JWT tokens, session management. Implement auth guards, interceptors for token handling. Secure token storage, implement refresh mechanism. Consider OAuth integration.

Sanitization Service prevents XSS by sanitizing values. Handles HTML, styles, URLs, resource URLs. Use bypassSecurityTrustHtml for trusted content. Important for dynamic content rendering.

Secure storage using encryption, HttpOnly cookies. Consider localStorage limitations, session storage. Implement secure token management. Important for sensitive data protection.

Route security through guards, proper navigation. Validate route parameters, implement access control. Consider deep linking security, route resolvers. Important for navigation security.

Security headers through server configuration, interceptors. Implement HSTS, CSP, X-Frame-Options. Consider browser compatibility, header requirements. Important for transport security.

Interceptors add security headers, handle tokens. Implement authentication, request/response transformation. Consider error handling, retry logic. Important for API security.

RBAC through guards, directives, services. Check user roles, permissions. Implement hierarchical roles, component visibility. Important for access management.

Secure coding includes: input validation, output encoding, proper error handling. Avoid dangerous APIs, implement security controls. Consider secure defaults, code review.

Secure transmission through HTTPS, proper encryption. Implement token-based authentication, secure headers. Consider data minimization, transport security. Important for data protection.

DOM-based XSS occurs through client-side JavaScript. Prevent through proper sanitization, avoiding dangerous APIs. Use Angular's built-in protections, validate user input. Consider template security.

Secure uploads through proper validation, type checking. Implement size limits, scan for malware. Consider storage location, access control. Important for upload security.

Form security through validation, CSRF protection. Implement proper error handling, input sanitization. Consider client/server validation, secure submission. Important for user input.

OAuth implementation through authentication libraries, proper flow. Handle token management, user sessions. Consider security best practices, implementation standards.

Same-Origin Policy restricts resource access between origins. Affects AJAX requests, cookies, DOM access. Configure CORS for cross-origin requests. Important for application security.

Service worker security through proper scope, HTTPS requirement. Implement secure caching, request handling. Consider update mechanism, cache poisoning prevention.

WebSocket security through authentication, message validation. Implement secure connection, proper error handling. Consider connection timeout, protocol security.

Secure state through proper storage, access control. Implement encryption for sensitive data, clear on logout. Consider state persistence, security implications.

Security tools include: npm audit, OWASP ZAP, SonarQube. Regular dependency checking, vulnerability scanning. Consider automation, continuous monitoring.

Secure sessions through proper timeout, token rotation. Implement session validation, concurrent session handling. Consider session fixation prevention.

Security testing through penetration testing, vulnerability scanning. Implement security unit tests, integration tests. Consider OWASP guidelines, security requirements.

Secure builds through proper configuration, optimization. Enable production mode, implement source map protection. Consider build optimization, security flags.

API security through proper authentication, rate limiting. Implement input validation, error handling. Consider API versioning, documentation security.

Secure error handling through proper message sanitization, logging. Implement user-friendly messages, avoid sensitive information. Consider error tracking, monitoring.

Security hardening through configuration, best practices. Implement security headers, proper permissions. Consider environment security, deployment practices.

Secure guards through proper authentication, authorization checks. Implement role-based access, navigation control. Consider guard composition, reusability.

PWA security through HTTPS requirement, secure manifests. Implement proper caching strategies, update mechanisms. Consider offline security, service worker security.