How do you ensure security in AngularJS applications, specifically regarding CSRF and CORS issues?
Instruction: Explain server and client responsibilities for CSRF prevention and CORS configuration in an existing AngularJS application.
Context: This question tests the candidate's knowledge of web security practices as applied within AngularJS applications.
Updated
Official answer available
Read the opening below, then unlock the full answer and practical guidance.
CSRF protection and CORS configuration solve different problems. Protect state-changing endpoints on the server and authorize every operation; a browser application cannot enforce those boundaries by itself.
AngularJS 1.8's $http can copy a JavaScript-readable XSRF-TOKEN cookie into the X-XSRF-TOKEN header. By default it sends that header only to the same origin, when the token exists. The framework neither generates a valid server token nor protects every possible request automatically...