controllerAs in AngularJS 1.5: Is it Enough to Prevent Accidental Public Access?

Answer

Using controllerAs alone does not guarantee that internal controller state remains hidden from templates. It merely shifts the public surface from the implicit $scope to the controller instance (the this object). Any property attached to this is visible to the view and to descendant scopes that reference the alias.

Why controllerAs is not a full safety net

• All properties on the controller instance are exposed through the alias.
• Child directives or nested controllers can access the same alias, potentially leaking sensitive data.
• Prototypal inheritance still applies; $scope assignments remain public if they exist.

When controllerAs is sufficient

For simple components where the public API is well‑defined and no sensitive data is stored on the controller instance, controllerAs provides a clear, readable pattern. It is often used in legacy AngularJS 1.x codebases and works well when combined with disciplined coding practices (e.g., avoid attaching hidden data to this).

When to prefer component() with isolated bindings

AngularJS 1.5’s component() helper creates a new isolated scope for the component and exposes only the bindings declared in its bindings object. This gives a stricter encapsulation boundary:

1. Define bindings: only the inputs/outputs you want public.
2. All other controller properties stay private to the component.
3. Child directives cannot access the parent component’s internals unless explicitly passed via bindings.

Practical verification steps

1. In a ng-controller="MyCtrl as vm" template, render {{vm.foo}} and {{vm.bar}} after assigning $scope.foo = 1 and this.bar = 2 in the controller. Both values will appear.

2. Create a child directive that injects the parent controller via require: '^?MyCtrl' and attempts to read vm.foo. The value will be accessible if the alias is used.

3. Switch the controller to a component() with isolated bindings. Verify that $scope.foo is no longer visible in the template and that only declared inputs appear.

Recommendation

Use controllerAs for quick, readable code when you can enforce discipline around what is attached to this. For modules that require true encapsulation—especially those that will eventually migrate to Angular (2+)—adopt component() with isolated bindings. This approach provides a clear, enforced boundary that protects internal state from accidental template exposure.