Angular & Signals (283 Qs)•Part 7: Change Detection, Security (XSS/Sanitizer) & Interceptors (151 - 176)
What is Angular security model for preventing XSS attacks?
Angular treats all values as untrusted by default. i.e, Angular sanitizes and escapes untrusted values When a value is inserted into the DOM from a template, via property, attribute, style, class binding, or interpolation.
Practical Code Example
html
<!-- Angular XSS Prevention: -->
<!-- Angular treats all interpolated strings as untrusted and escapes malicious scripts automatically: -->
<p>{{ userGeneratedScript }}</p>
<!-- <script>alert('xss')</script> is rendered as plain safe text, not executed! -->