Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

docs: add angular#bundler to Enforcing Trusted Types section #45450

Closed
wants to merge 1 commit into from
Closed

docs: add angular#bundler to Enforcing Trusted Types section #45450

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
7 changes: 7 additions & 0 deletions aio/content/guide/security.md
View file
Open in desktop
Expand Up @@ -201,6 +201,7 @@ To enforce Trusted Types for your application, you must configure your applicati
| `angular` | This policy is used in security-reviewed code that is internal to Angular, and is required for Angular to function when Trusted Types are enforced. Any inline template values or content sanitized by Angular is treated as safe by this policy. |
| `angular#unsafe-bypass` | This policy is used for applications that use any of the methods in Angular's [DomSanitizer](api/platform-browser/DomSanitizer) that bypass security, such as `bypassSecurityTrustHtml`. Any application that uses these methods must enable this policy. |
| `angular#unsafe-jit` | This policy is used by the [JIT compiler](api/core/Compiler). You must enable this policy if your application interacts directly with the JIT compiler or is running in JIT mode using the [platform browser dynamic](api/platform-browser-dynamic/platformBrowserDynamic). |
| `angular#bundler` | This policy is used by Angular CLI's bundler when creating lazy chunk files. |

You should configure the HTTP headers for Trusted Types in the following locations:

Expand Down Expand Up @@ -232,6 +233,12 @@ Content-Security-Policy: trusted-types angular angular#unsafe-jit; require-trust

</code-example>

The following is an example of a header specifically configured for Trusted Types and Angular applications that use lazy loading of modules:

<code-example language="html">
Content-Security-Policy: trusted-types angular angular#bundler; require-trusted-types-for 'script';
</code-example>

<div class="callout is-helpful">

<header>Community contributions</header>
Expand Down