Improve this Doc  View Source

$sceDelegateProvider

  1. - $sceDelegate
  2. - provider in module ng

Overview

The $sceDelegateProvider provider allows developers to configure the $sceDelegate service, used as a delegate for Strict Contextual Escaping (SCE).

The $sceDelegateProvider allows one to get/set the trustedResourceUrlList and bannedResourceUrlList used to ensure that the URLs used for sourcing AngularJS templates and other script-running URLs are safe (all places that use the $sce.RESOURCE_URL context). See $sceDelegateProvider.trustedResourceUrlList and $sceDelegateProvider.bannedResourceUrlList,

For the general details about this service in AngularJS, read the main page for Strict Contextual Escaping (SCE).

Example: Consider the following case.

Here is what a secure configuration for this scenario might look like:

angular.module('myApp', []).config(function($sceDelegateProvider) {
  $sceDelegateProvider.trustedResourceUrlList([
    // Allow same origin resource loads.
    'self',
    // Allow loading from our assets domain.  Notice the difference between * and **.
    'http://srv*.assets.example.com/**'
  ]);

  // The banned resource URL list overrides the trusted resource URL list so the open redirect
  // here is blocked.
  $sceDelegateProvider.bannedResourceUrlList([
    'http://myapp.example.com/clickThru**'
  ]);
});

Note that an empty trusted resource URL list will block every resource URL from being loaded, and will require you to manually mark each one as trusted with $sce.trustAsResourceUrl. However, templates requested by $templateRequest that are present in $templateCache will not go through this check. If you have a mechanism to populate your templates in that cache at config time, then it is a good idea to remove 'self' from the trusted resource URL lsit. This helps to mitigate the security impact of certain types of issues, like for instance attacker-controlled ng-includes.

Methods