diff --git a/adev/src/content/guide/http/making-requests.md b/adev/src/content/guide/http/making-requests.md index 96b22ea1fe3..96569efde02 100644 --- a/adev/src/content/guide/http/making-requests.md +++ b/adev/src/content/guide/http/making-requests.md @@ -434,6 +434,51 @@ Available `credentials` values: TIP: Use `credentials: 'include'` when you need to send authentication cookies or headers to a different domain that supports CORS. Avoid mixing `credentials` and `withCredentials` options to prevent confusion. +#### Referrer + +The `referrer` option allows you to control what referrer information is sent with the request. This is important for privacy and security considerations. + + +// Send a specific referrer URL +http.get('/api/data', { + referrer: 'https://example.com/page' +}).subscribe(data => { + // ... +}); + +// Use the current page as referrer (default behavior) +http.get('/api/analytics', { + referrer: 'about:client' +}).subscribe(data => { + // ... +}); + + +The `referrer` option accepts: +- A valid URL string: Sets the specific referrer URL to send +- An empty string `''`: Sends no referrer information +- `'about:client'`: Uses the default referrer (current page URL) + +TIP: Use `referrer: ''` for sensitive requests where you don't want to leak the referring page URL. + +#### Integrity + +The `integrity` option allows you to verify that the response hasn't been tampered with by providing a cryptographic hash of the expected content. This is particularly useful for loading scripts or other resources from CDNs. + + +// Verify response integrity with SHA-256 hash +http.get('/api/script.js', { + integrity: 'sha256-ABC123...', + responseType: 'text' +}).subscribe(script => { + // Script content is verified against the hash +}); + + +IMPORTANT: The `integrity` option requires an exact match between the response content and the provided hash. If the content doesn't match, the request will fail with a network error. + +TIP: Use subresource integrity when loading critical resources from external sources to ensure they haven't been modified. Generate hashes using tools like `openssl`. + ## Http `Observable`s Each request method on `HttpClient` constructs and returns an `Observable` of the requested response type. Understanding how these `Observable`s work is important when using `HttpClient`.