Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
What Changed in Frontend Security from Angular 11 to 22 and in Browsers
From Angular 11 to 22 most security features arrived in patches rather than new majors, so auditing an old project means checking the exact version, not the major. In this post we verify the version of each feature from Trusted Types to autoCsp and SSR allowedHosts from package tarballs, show in headless Chrome that 22.0.8 does not send the XSRF header, collect the browser changes and produce a runnable audit script.
Angular SSR Security: allowedHosts, Host Header Validation, TransferState and Secrets Leaking into Bundles
In Angular SSR the server resolves relative HttpClient URLs against the incoming request's Host header, so fill allowedHosts with explicit names, trust proxy headers only behind a trusted proxy and do not derive the API address from Host. On a local SSR server we show SSRF, the 2026 advisories, fields leaking into TransferState, a nonce-based CSP under SSR and secrets ending up in bundles and source maps, all with real output.