Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Angular was and is a frontend framework. "Security issues" may alter the authentication state of the frontend but the server should always check if operations are authorised. Lets assume the server runs php or .net. Security patches are crucial to avoid eg. code injection or malicious request forgery and thus should always be applied, maybe also upgrade the runtime version if possible.

Please tell me in which scenario a frontend issue is a security issue because I'm more the backend architect, not a naive developer.



You're focused on the security of your own server, but an insecure or compromised front end can be used to leverage your site's utility or popularity to attack your end users or be used against other sites. Just read up on XSS.

Your server can remain perfectly secure and uncompromised while your front end drags your company or project's reputation through the mud.


I mentioned in my first sentence that my reply was not really regarding Angular. But yeah, I looked it up. Here is a link to the CVEs for Angular, mainly XSS like the sibling comment explains.

https://www.cvedetails.com/vendor/18512/Angularjs.html




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: