Blog
Angular HttpClient: CORS, HTTP interceptors, and XSRF cookie-to-header flow with credentialed requests
Angular’s XSRF strategy adds non-simple headers—your API must list them in Access-Control-Allow-Headers alongside Authorization.
1 min read
angularhttpclientcors
Zone.js and SSR
Server-side rendering should not call browser-only APIs—centralize API base URLs in environment files per deploy target.
Hydration mismatches can duplicate requests and amplify preflight traffic during first paint.
Libraries
Third-party Angular modules may register interceptors that alter headers—audit order before production cutovers.
Ivy tree-shaking does not remove CORS requirements; document which bundles hit which origins.