那是否意味着angular2不建议在服务器端进行渲染

Question

I got that angular2 could render in server side(even I don't know what's the benefit), and I really see an example of angular2 server side.

Angular 2 Universal Starter

But it seems angular2 official doesn't suggest this.

Server side XSS protection from angular2 doc

HTML constructed on the server is vulnerable to injection attacks. Injecting template code into an Angular application is the same as injecting executable code into the application; it gives the attacker full control over the application. To prevent this, make sure to use a templating language that automatically escapes values to prevent XSS vulnerabilities on the server. Do not generate Angular templates on the server side using a templating language, this carries a high risk of introducing template injection vulnerabilities.

How to understand it?

Answer 1

XSS can be caused by user-provided data added to the DOM.

This is not what server-side rendering is about. Server-side rendering is about executing your Angular2 application on the server, caching the result and sending the resulting DOM to the client, so that the client has less initialization work to do and can do the initial render in shorter time.

This can cause user-provided data to be added to the DOM if your Angular2 application code is doing this. Angular2 does sanitize added HTML to prevent XSS also when rendered on the server. If you prevent this by marking a string as safe using DomSanitizationService then you again become susceptible to XSS attacks.

Answer 2

Do not generate Angular templates on the server side using a templating language, this carries a high risk of introducing template injection vulnerabilities.

Relying on Angular 2 to sanitize HTML to prevent XSS is not enough. An adversary could inject Angular expressions, such as {{1==1}} , into the server side template. {{1==1}} may be a harmless example, but check out this exmaple where you can get a user's authentication token. This is why generating Angular templates on the server is dangerous. You have to ensure that an adversary can't inject malicious Angular expressions.