Improve this doc View Source

The `$sceDelegateProvider` provider allows developers to configure the $sceDelegate service. This allows one to get/set the whitelists and blacklists used to ensure that the URLs used for sourcing Angular templates are safe. Refer $sceDelegateProvider.resourceUrlWhitelist and $sceDelegateProvider.resourceUrlBlacklist

For the general details about this service in Angular, read the main page for Strict Contextual Escaping (SCE).

Example: Consider the following case.

- your app is hosted at url `http://myapp.example.com/`
- but some of your templates are hosted on other domains you control such as `http://srv01.assets.example.com/`, `http://srv02.assets.example.com/`, etc.
- and you have an open redirect at `http://myapp.example.com/clickThru?...`.

Here is what a secure configuration for this scenario might look like:

     angular.module('myApp', []).config(function($sceDelegateProvider) {
       $sceDelegateProvider.resourceUrlWhitelist([
         // Allow same origin resource loads.
         'self',
         // Allow loading from our assets domain.  Notice the difference between * and **.
         'http://srv*.assets.example.com/**'
       ]);

       // The blacklist overrides the whitelist so the open redirect here is blocked.
       $sceDelegateProvider.resourceUrlBlacklist([
         'http://myapp.example.com/clickThru**'
       ]);
     });

## Methods

- ###

  `resourceUrlWhitelist([whitelist]);`

  Sets/Gets the whitelist of trusted resource URLs.

  #### Parameters

  Param | Type | Details
  --- | --- | ---
  whitelist (optional) | Array | When provided, replaces the resourceUrlWhitelist with the value provided. This must be an array or null. A snapshot of this array is used so further changes to the array are ignored.
      Follow this link for a description of the items
      allowed in this array.

      Note: **an empty whitelist array will block all URLs**!

  #### Returns

  Array | the currently set whitelist array. The default value when no whitelist has been explicitly set is `['self']` allowing only same origin resource requests.

- ###

  `resourceUrlBlacklist([blacklist]);`

  Sets/Gets the blacklist of trusted resource URLs.

  #### Parameters

  Param | Type | Details
  --- | --- | ---
  blacklist (optional) | Array | When provided, replaces the resourceUrlBlacklist with the value provided. This must be an array or null. A snapshot of this array is used so further changes to the array are ignored.
      Follow this link for a description of the items
      allowed in this array.

      The typical usage for the blacklist is to **block
      [open redirects](http://cwe.mitre.org/data/definitions/601.html)** served by your domain as
      these would otherwise be trusted but actually return content from the redirected domain.

      Finally, **the blacklist overrides the whitelist** and has the final say.

  #### Returns

  Array | the currently set blacklist array. The default value when no whitelist has been explicitly set is the empty array (i.e. there is no blacklist.)