Angular Security

This covers the core security patterns you need when building Angular apps, from XSS prevention and CSRF protection to Content Security Policy setup. You get practical examples of DomSanitizer usage, HttpClient CSRF configuration, and router guards for authentication. It's updated for Angular 21 with newer features like Trusted Types support and the provideZoneChangeDetection security options. The examples are straightforward and show both the dangerous patterns to avoid and the safe alternatives. If you're handling user input, third-party content, or need to lock down routes, this gives you the essential patterns without drowning you in theory.

skills.sh installs: 211
GitHub stars: 7
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add oguzhan18/angular-ecosystem-skills --skill angular-security --agent claude-code

Installs into .claude/skills of the current project.

Files

Angular Security

Version: Angular 21 (2025) Tags: Security, XSS, CSRF, CSP, Sanitization

References: Security Guide • DomSanitizer

API Changes

This section documents recent version-specific API changes.

NEW: Trusted Types — Angular supports Trusted Types for CSP
NEW: HttpClient CSRF — Built-in CSRF protection with CookieXSRFStrategy
NEW: provideZoneChangeDetection with untrustedEvents — Zone.js event filtering
NEW: afterNextRender security — Run code safely after rendering

Best Practices

Use DomSanitizer for safe HTML

import { DomSanitizer, SafeHtml } from '@angular/platform-browser';

constructor(private sanitizer: DomSanitizer) {}

getSafeHtml(html: string): SafeHtml {
  return this.sanitizer.bypassSecurityTrustHtml(html);
}