如何保护Angular 2 SPA免受XSS攻击？

Question

I need to secure my SPA from XSS. I use Angular 2 for the client side and REST services in JAVA on the server.

I know that Angular treats all inputs in the template as unsecure and sanitize and escapes html tags, etc. there is also the protection built in the browsers using the X-XSS header.

Do I need to do some protection on the server side? handle the data sent from/to the client?

if so is there a java library that wraps all the requests and secure them from XSS?

one of the requests is to save a password and I want to allow special characters, how do I not change the password`s characters and still being secure?

Thanks!

Answer 1

Never trust the client! For your Java Backend you can use for example the AntiSamy Project from the OWASP. It helps you that clients don't supply malicious cargo code via HTML/CSS that get persisted on the server.