The $sceDelegateProvider provider allows developers to configure the $sceDelegate service. This allows one to get/set the whitelists and blacklists used to ensure
that the URLs used for sourcing Angular templates are safe. Refer $sceDelegateProvider.resourceUrlWhitelist and
$sceDelegateProvider.resourceUrlBlacklist
For the general details about this service in Angular, read the main page for Strict Contextual Escaping (SCE).
Example: Consider the following case.
http://myapp.example.com/http://srv01.assets.example.com/, http://srv02.assets.example.com/, etc.http://myapp.example.com/clickThru?....Here is what a secure configuration for this scenario might look like:
angular.module('myApp', []).config(function($sceDelegateProvider) {
$sceDelegateProvider.resourceUrlWhitelist([
// Allow same origin resource loads.
'self',
// Allow loading from our assets domain. Notice the difference between * and **.
'http://srv*.assets.example.com/**'
]);
// The blacklist overrides the whitelist so the open redirect here is blocked.
$sceDelegateProvider.resourceUrlBlacklist([
'http://myapp.example.com/clickThru**'
]);
});
resourceUrlWhitelist([whitelist]);
Sets/Gets the whitelist of trusted resource URLs.
| Param | Type | Details |
|---|---|---|
|
whitelist
(optional)
|
Array |
When provided, replaces the resourceUrlWhitelist with the value provided. This must be an array or null. A snapshot of this array is used so further changes to the array are ignored.
|
| Array | the currently set whitelist array. The default value when no whitelist has been explicitly set is |
resourceUrlBlacklist([blacklist]);
Sets/Gets the blacklist of trusted resource URLs.
| Param | Type | Details |
|---|---|---|
|
blacklist
(optional)
|
Array |
When provided, replaces the resourceUrlBlacklist with the value provided. This must be an array or null. A snapshot of this array is used so further changes to the array are ignored.
|
| Array | the currently set blacklist array. The default value when no whitelist has been explicitly set is the empty array (i.e. there is no blacklist.) |