View source Improve this doc

$sceDelegateProvider
service in module ng

Description

The $sceDelegateProvider provider allows developers to configure the $sceDelegate service. This allows one to get/set the whitelists and blacklists used to ensure that the URLs used for sourcing Angular templates are safe. Refer $sceDelegateProvider.resourceUrlWhitelist and $sceDelegateProvider.resourceUrlBlacklist

For the general details about this service in Angular, read the main page for Strict Contextual Escaping (SCE).

Example: Consider the following case.

  • your app is hosted at url http://myapp.example.com/
  • but some of your templates are hosted on other domains you control such as http://srv01.assets.example.com/, http://srv02.assets.example.com/, etc.
  • and you have an open redirect at http://myapp.example.com/clickThru?....

Here is what a secure configuration for this scenario might look like:

   angular.module('myApp', []).config(function($sceDelegateProvider) {
     $sceDelegateProvider.resourceUrlWhitelist([
       // Allow same origin resource loads.
       'self',
       // Allow loading from our assets domain.  Notice the difference between * and **.
       'http://srv*.assets.example.com/**']);

     // The blacklist overrides the whitelist so the open redirect here is blocked.
     $sceDelegateProvider.resourceUrlBlacklist([
       'http://myapp.example.com/clickThru**']);
     });

Methods