What are Angular’s security features for protecting

gainst XSS and CSRF?

• XSS (Cross-Site Scripting) Protection:
• Angular automatically sanitizes dangerous content in templates (e.g., {{

userInput }}).

• Use DomSanitizer for trusted content.
• Binding syntax prevents direct HTML injection.
• CSRF (Cross-Site Request Forgery) Protection:
• Angular’s HttpClient works with backend CSRF tokens.
• Common approach: Backend sends CSRF token, Angular sends it back via

headers or cookies.

• Developers must implement token handling in interceptors.