Angular Security - Interview Questions

1. How do you secure an Angular + ASP.NET Core application?

Use HTTPS, JWT authentication, server-side authorization, input validation, CORS, CSP, and secure token storage. Keep secrets on the backend and regularly update dependencies.

2. What is Cross-Site Scripting (XSS)?

XSS is a security vulnerability where attackers inject malicious JavaScript into a trusted website. It can steal accessible tokens, manipulate pages, or perform unauthorized actions.

3. How does Angular help prevent XSS?

Angular automatically escapes interpolated text and sanitizes untrusted values in security-sensitive template bindings. Avoid direct DOM manipulation and unsafe use of bypassSecurityTrustHtml().

<p>{{ userInput }}</p>
<div [innerHTML]="userContent"></div>

Key Point: Angular's built-in protections do not eliminate every XSS risk.

4. What is Cross-Site Request Forgery (CSRF)?

CSRF is an attack that tricks an authenticated user's browser into sending unwanted requests to a website. It commonly exploits automatically attached authentication cookies.

5. When is CSRF relevant to Angular + ASP.NET Core applications?

CSRF is particularly relevant when authentication uses cookies automatically sent by the browser. Bearer tokens manually attached through Authorization headers are generally less exposed to traditional CSRF.

6. How do you prevent CSRF when cookie authentication is used?

Use ASP.NET Core antiforgery tokens, SameSite cookies, and server-side token validation. Angular can send an antiforgery token in a custom request header.

provideHttpClient(withXsrfConfiguration({
  cookieName: 'XSRF-TOKEN', headerName: 'X-XSRF-TOKEN'
}))

Key Point: Angular's built-in XSRF support targets mutating relative or same-origin URLs; cross-origin API setups need additional configuration.

7. What is Content Security Policy (CSP)?

CSP is a browser security mechanism that restricts which scripts, styles, and other resources can load. It helps reduce XSS risks by blocking unauthorized script execution.

Content-Security-Policy: default-src 'self'; script-src 'self'

8. Why should Angular never contain database credentials?

Angular runs in the browser, where its JavaScript and configuration can be inspected. Database passwords and private API secrets must remain on the ASP.NET Core server.

9. Why should authorization never rely only on the Angular UI?

Angular UI restrictions and route guards can be bypassed or modified by users. ASP.NET Core must enforce authorization independently for every protected endpoint.

10. How do you prevent unauthorized API access?

Use JWT Bearer authentication, [Authorize], role-based or policy-based authorization, and resource-level permission checks. Validate tokens and permissions on the server.

[Authorize(Roles = "Admin")]
[HttpDelete("{id}")]
public IActionResult Delete(int id) => Ok();

11. How do you secure sensitive routes?

Use Angular CanActivateFn guards to restrict navigation and ASP.NET Core [Authorize] to protect backend resources. Never rely on guards as the only security layer.

export const adminGuard: CanActivateFn = () =>
  inject(AuthService).isAdmin() || inject(Router).createUrlTree(['/forbidden']);

12. How do you securely manage JWT tokens?

Use short-lived access tokens, HTTPS, restricted token scope, and secure storage. Prefer in-memory access tokens and avoid storing long-lived credentials in localStorage.

13. How do you protect refresh tokens?

Store refresh tokens in Secure, HttpOnly, appropriately configured SameSite cookies. Implement token rotation, server-side revocation, expiration, and reuse detection.

Response.Cookies.Append("refreshToken", token,
    new CookieOptions { HttpOnly = true, Secure = true, SameSite = SameSiteMode.Strict });

Key Point: Cookie-based refresh endpoints also need appropriate CSRF protection.

14. How do HTTPS and HSTS protect the application?

HTTPS encrypts communication between the browser and server, protecting data in transit. HSTS instructs browsers to use HTTPS for future connections.

app.UseHttpsRedirection();
app.UseHsts();

Key Point: HSTS is typically enabled in production after HTTPS is correctly configured.

Important Interview Revision Points

Angular + ASP.NET Core Security Flow

Angular Application
       |
       | HTTPS
       | JWT Bearer Token
       v
ASP.NET Core Web API
       |
       | 1. Authentication
       | 2. Token Validation
       | 3. Role / Policy Authorization
       | 4. Input Validation
       | 5. Business Rules
       v
SQL Server
       |
       | Secure Connection
       | Credentials Stored Server-Side

Interview priority: Focus particularly on questions 1, 2, 3, 4, 5, 6, 7, 9, 10, 12, 13, and 14.

Key interview takeaway: Angular provides client-side security protections, but ASP.NET Core must enforce authentication, authorization, validation, and data security. Never trust the browser as a security boundary.