Sigurnost web aplikacija realiziranih programskim razvojnim okvirom Angular

master's thesis

• Title (english): Security of web applications implemented by the Angular software development framework
• Author: Mario Kovačević
• Mentor: Mirta Baranović (mentor)
• Committee member: Mirta Baranović (predsjednik povjerenstva)
• Committee member: Vedran Mornar (član povjerenstva)
• Committee member: Slaven Zakošek (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2020-07-06, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

U ovome radu istražena je sigurnost web aplikacija čiji je klijentski dio izgrađen razvojnim
okvirom Angular. Uvodni dio dotiče se web aplikacija i razloga za njihovu sigurnost.
Zatim su prikazane osnovne značajke Angulara te aplikacija koja je izgrađena kao
praktični dio ovoga istraživanja. Ona je dizajnirana na što nesigurniji način te ne sadrži nikakvu
dodanu zaštitu. U trećem poglavlju, opisane su ranjivosti i napadi na implementiranoj
aplikaciji, kao i mjere zaštite za njihovu prevenciju. Nakon toga, prikazane su brojne
implicitne i eksplicitne metode najbolje prakse pri radu s Angularom pomoću kojih se
također postiže veća razina sigurnosti. Implementiranjem spomenute zaštite i metoda
najbolje prakse, stvorila se sigurna verzija iste aplikacije. U petome poglavlju prikazano je
paralelno sigurnosno testiranje ranjive i sigurne verzije aplikacije. Na kraju je su prikazane
sigurnosne prednosti i mane razvojnog okvira Angular uz pripadajući zaključak

Abstract (english)

In this research, the security of web applications where the client part is built using
Angular development framework, is described. Web applications and the reasons for their
security are mentioned in the introductory part. Then, the basic features of Angular and the
application that was built as a practical part of this research are presented. Application is
designed in the most insecure way possible and does not contain any added protection. In
the third chapter, vulnerabilities and attacks on the implemented application are described,
as well as protection measures for their prevention. After that, a number of implicit and
explicit methods of best practice in Angular are presented, which also achieve a higher
level of safety. By implementing the mentioned protection and best practice methods, a
secure version of the same application was created. Fifth chapter presents parallel security
testing of a vulnerable and secure version of an application. Finally, the security
advantages and disadvantages of the Angular framework are presented with the
corresponding conclusion.

• Keywords: Web aplikacija; Angular; TypeScript; Express; sigurnost; ranjivost; napad; zaštita; XSS; CSRF; testiranje; HTTPS; sigurnosna zaglavlja; politika sigurnosti sadržaja; najbolja praksa; kolačić; validacija; sanitizacija; autentikacija; autorizacija
• Keywords (english): Web application; Angular; TypeScript; Express; security; vulnerability; attack; protection; XSS; CSRF; testing; HTTPS; security headers; content security policy; best practice; cookie; validation; sanitization; authentication; authorization
• Language: croatian
• URN:NBN: urn:nbn:hr:168:269208
• Study programme: Title: Computing; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra inženjer/inženjerka računarstva (magistar/magistra inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2023-01-13 12:45:11