anchor.diff:    your intended use of the value. Imagine the following template needs to bind a URL to a
     `javascript:alert(...)` call.
   
  +  记住，一个值是否安全依赖于它所在的环境，所以你要为这个值的预定用法选择正确的环境。假设下面的的模版需要绑定URL到`javascript.alert(...)`方法。
  +
   +makeExample('security/ts/app/bypass-security.component.html', 'dangerous-url')(format=".")
   :marked
     Normally, Angular would automatically sanitize the URL and disable the dangerous code. To prevent
     this, we can mark the URL value as a trusted URL using the `bypassSecurityTrustUrl` call:
  +
  +  一般情况下，Angular会自动无毒化这个URL并禁止危险的代码。为了防止这种行为，我们可以调用`bypassSecurityTrustUrl`，来标记这个URL值为一个信任的URL：
   
   +makeExample('security/ts/app/bypass-security.component.ts', 'trust-url')(format=".")
   figure.image-display
  
positive.code:   method on the controller to construct a new, trusted video URL, which is then bound to the
    `<iframe src>`.
  
  +makeExample('security/ts/app/bypass-security.component.html', 'iframe-videoid')(format=".")
  +makeExample('security/ts/app/bypass-security.component.ts', 'trust-video-url')(format=".")
  
  .l-main-section
  h2#http HTTP-level Vulnerabilities
  :marked
    Angular has built in support to help prevent two common HTTP vulnerabilities, Cross-site Request
    Forgery (XSRF) and Cross-site Script Inclusion (XSSI). Both of these must be primarily mitigated
    on the server side, but Angular ships helpers to make integration on the client side easier.
  
  h3#xsrf Cross-site Request Forgery (XSRF)
  :marked
    In a Cross-site Request Forgery (XSRF or CSRF), an attacker tricks the user into visiting a
    _different_ page, and has them e.g. submit a form that sends a request to your application's
    web server. If the user is logged into your application, the browser will send authentication
    cookies, and the attacker could - for example - cause a bank transfer in the user's name with
    the right request.
  
    To prevent this, your application must make sure that user requests originate in your own
    application, not on a different site. A common technique is that the server sends a randomly
  
negative.code:   [Dynamic Forms Cookbook](../cookbook/dynamic-form.html) on how to dynamically construct forms in a
    safe way.
  
    离线模版编译器防止一整套叫做模版注入的漏洞，并能在很大程度上增强应用程序性能。在产品发布时使用离线模板编译器。
    不要动态的生成模版。Angular信任模版代码，所以生成模版，尤其是包含用户数据的模版能规避Angular自带的保护。
    参见[动态表单烹饪书](../cookbook/dynamic-form.html)关于如何安全的动态创建表单。
  
    ### Server side XSS protection
    
    ### 服务器端XSS保护
  
    HTML constructed on the server is vulnerable to injection attacks. When generating server side
    HTML, e.g. for the initial page load of the Angular application, make sure to use a templating
  