MEAN Stack Security Blueprint

To secure a MEAN Stack application, you need to: (1) use Angular's built-in XSS protection and HTTP interceptors for auth, (2) implement Express security middleware (helmet, CORS, rate limiting), (3) sanitize MongoDB queries with express-mongo-sanitize, (4) use express-validator for input validation, and (5) understand that Angular route guards are UX-only-Express APIs must verify auth. This blueprint covers Angular-specific security with Express backend patterns.

TL;DR

MEAN Stack shares MongoDB/Express concerns with MERN but adds Angular-specific security. Use Angular's built-in XSS protection, implement HTTP interceptors for auth, sanitize all MongoDB queries, and use route guards for client-side protection (with server validation).

Angular HTTP Interceptor Angular

src/app/interceptors/auth.interceptor.ts

import { Injectable } from '@angular/core'
import { HttpInterceptor, HttpRequest, HttpHandler } from '@angular/common/http'
import { AuthService } from '../services/auth.service'

@Injectable()
export class AuthInterceptor implements HttpInterceptor {
  constructor(private auth: AuthService) {}

  intercept(req: HttpRequest<any>, next: HttpHandler) {
    const token = this.auth.getToken()

    if (token) {
      req = req.clone({
        setHeaders: {
          Authorization: `Bearer ${token}`,
        },
      })
    }

    return next.handle(req)
  }
}

Angular Route Guards Angular

src/app/guards/auth.guard.ts

import { Injectable } from '@angular/core'
import { CanActivate, Router } from '@angular/router'
import { AuthService } from '../services/auth.service'

@Injectable({ providedIn: 'root' })
export class AuthGuard implements CanActivate {
  constructor(private auth: AuthService, private router: Router) {}

  canActivate(): boolean {
    if (this.auth.isAuthenticated()) {
      return true
    }
    this.router.navigate(['/login'])
    return false
  }
}

Express API with Validation Express

server/routes/posts.js

import express from 'express'
import { body, validationResult } from 'express-validator'
import { protect } from '../middleware/auth.js'
import Post from '../models/Post.js'

const router = express.Router()

router.post('/',
  protect,
  [
    body('title').trim().isLength({ min: 1, max: 200 }).escape(),
    body('content').trim().isLength({ min: 1 }),
  ],
  async (req, res) => {
    const errors = validationResult(req)
    if (!errors.isEmpty()) {
      return res.status(400).json({ errors: errors.array() })
    }

    const post = await Post.create({
      title: req.body.title,
      content: req.body.content,
      author: req.user._id,  // Verified user ID
    })

    res.status(201).json(post)
  }
)

Route guards are UX only. Angular guards prevent navigation but don't protect data. Your Express API must verify authentication on every request.