The $sceDelegateProvider
provider allows developers to configure the $sceDelegate service. This allows one to get/set the whitelists and blacklists used to ensure
that the URLs used for sourcing Angular templates are safe. Refer $sceDelegateProvider.resourceUrlWhitelist and
$sceDelegateProvider.resourceUrlBlacklist
For the general details about this service in Angular, read the main page for Strict Contextual Escaping (SCE).
Example: Consider the following case.
http://myapp.example.com/
http://srv01.assets.example.com/
, http://srv02.assets.example.com/
, etc.http://myapp.example.com/clickThru?...
.Here is what a secure configuration for this scenario might look like:
angular.module('myApp', []).config(function($sceDelegateProvider) { $sceDelegateProvider.resourceUrlWhitelist([ // Allow same origin resource loads. 'self', // Allow loading from our assets domain. Notice the difference between * and **. 'http://srv*.assets.example.com/**']); // The blacklist overrides the whitelist so the open redirect here is blocked. $sceDelegateProvider.resourceUrlBlacklist([ 'http://myapp.example.com/clickThru**']); });
resourceUrlWhitelist([whitelist]);
Sets/Gets the whitelist of trusted resource URLs.
Param | Type | Details |
---|---|---|
whitelist
(optional)
|
Array |
When provided, replaces the resourceUrlWhitelist with the value provided. This must be an array or null. A snapshot of this array is used so further changes to the array are ignored.
|
Array | the currently set whitelist array. The default value when no whitelist has been explicitly set is |
resourceUrlBlacklist([blacklist]);
Sets/Gets the blacklist of trusted resource URLs.
Param | Type | Details |
---|---|---|
blacklist
(optional)
|
Array |
When provided, replaces the resourceUrlBlacklist with the value provided. This must be an array or null. A snapshot of this array is used so further changes to the array are ignored.
|
Array | the currently set blacklist array. The default value when no whitelist has been explicitly set is the empty array (i.e. there is no blacklist.) |