Why should you care?

Stolen session via XSS bypasses password strength — defense is encoding and CSP.

See it live — copy this example

Paste into your MeanVerse project (Angular + Express + MongoDB), then run with ng serve / node / mongosh as noted.

// Angular auto-escapes {{ user.name }} — safe
// Dangerous: bypassSecurityTrustHtml unless sanitized
import { DomSanitizer } from '@angular/platform-browser';

safeBio = computed(() =>
  this.sanitizer.sanitize(SecurityContext.HTML, this.profile().bio) ?? ''
);

// Express: never reflect raw input in HTML emails
res.json({ note: validator.escape(req.body.note) });

What happened?

• Angular templates escape by default.
• DomSanitizer strips scripts from rich text.
• Server escapes if generating HTML; JSON APIs still must not execute input in admin tools.

Practice next

1. Audit bypassSecurityTrust* usage in Angular.
2. Store plain text notes; render with default binding.
3. Set CSP header blocking inline scripts.
4. Add CSP nonce for required inline styles only.
5. Run npm audit on Angular dependency XSS CVEs.

Remember

Default Angular binding escapes HTML. Sanitize rich text explicitly. CSP + httpOnly cookies limit XSS impact.

CRM note field

Attacker stores