fix(http): run root interceptors in the terminal request chain by SkyZeroZx · Pull Request #69778 · angular/angular

SkyZeroZx · 2026-07-15T05:00:39Z

Represent withRequestsMadeViaParent() with an internal delegating backend so the interceptor handler can distinguish delegated clients from independent child configurations.

Delegated clients leave inherited root interceptors to the parent chain. This prevents duplicate execution and lets HttpTransferCache evaluate authentication and cache filters after parent request interceptors, while independent child clients continue to inherit framework root interceptors.

Add coverage for independent root inheritance, request and response ordering, authenticated requests, cache filters, and public cache hits.

Fixes #69777

This seems similar to GHSA-q6f4-qqrg-jv6x ( In fact, no filter or exclusion is currently applied )

JeanMeche · 2026-07-15T14:23:21Z

          );
        }
-        return handlerFromParent;
+        return new HttpParentBackend(handlerFromParent!);


What would you think of defining a separate token instead of creating a separate HttpBackend instance ?

Are you referring to using a DI token as a boolean flag here?

I considered it, but after reviewing the git history, it seems we might have a case like this #55652

A boolean token could become stale if another provider overrides HttpBackend, causing inherited root interceptors to be skipped incorrectly.

Or did you mean using a token for the parent handler and comparing it with the current HttpBackend instance?

In that case, I believe it would be something like the following (I haven't tested it), personally I would prefer the class that seemed simpler to me

const HTTP_PARENT_HANDLER = new InjectionToken<HttpHandler>('HTTP_PARENT_HANDLER'); // withRequestsMadeViaParent() [ { provide: HTTP_PARENT_HANDLER, useFactory: () => inject(HttpHandler, {skipSelf: true}), }, { provide: HttpBackend, useExisting: HTTP_PARENT_HANDLER, }, ]; // HttpInterceptorHandler private readonly parentHandler = inject(HTTP_PARENT_HANDLER, { self: true, optional: true, }); const rootInterceptorFns = this.injector.get( HTTP_ROOT_INTERCEPTOR_FNS, [], this.backend === this.parentHandler ? {self: true} : undefined, );

Was more think of something like:

export const ɵHTTP_CLIENT_IS_DELEGATING = new InjectionToken<boolean>('ɵHTTP_CLIENT_IS_DELEGATING'); // packages/common/http/src/provider.ts export function withRequestsMadeViaParent(): HttpFeature<HttpFeatureKind.RequestsMadeViaParent> { return makeHttpFeature(HttpFeatureKind.RequestsMadeViaParent, [ { provide: HttpBackend, useFactory: () => { const handlerFromParent = inject(HttpHandler, {skipSelf: true, optional: true}); // ... error handling ... return handlerFromParent; // Return directly }, }, { provide: ɵHTTP_CLIENT_IS_DELEGATING, useValue: true } ]); } // packages/common/http/src/backend.ts (Inside HttpInterceptorHandler) handle(initialRequest: HttpRequest<any>): Observable<HttpEvent<any>> { if (this.chain === null) { // Query with {self: true} to strictly check if the *current* client configuration is delegating const isDelegating = this.injector.get(ɵHTTP_CLIENT_IS_DELEGATING, false, {self: true}); const rootInterceptorFns = this.injector.get( HTTP_ROOT_INTERCEPTOR_FNS, [], isDelegating ? {self: true} : undefined, ); // ...

I tried this approach, but the token can become stale if another feature overrides HttpBackend.

Eg : with withRequestsMadeViaParent() and withXhr(), XHR becomes the effective backend while the token remains true, so inherited root interceptors are skipped. This test reproduces it.

it('should inherit root interceptors when withXhr overrides parent delegation', () => { TestBed.configureTestingModule({ providers: [ provideHttpClient(), { provide: HTTP_ROOT_INTERCEPTOR_FNS, useValue: makeLiteralTagInterceptorFn('root'), multi: true, }, ], }); const child = createEnvironmentInjector( [ provideHttpClient(withRequestsMadeViaParent(), withXhr()), {provide: XhrFactory, useClass: MockXhrFactory}, ], TestBed.inject(EnvironmentInjector), ); try { child.get(HttpClient).get('/test').subscribe(); const factory = child.get(XhrFactory) as MockXhrFactory; expect(factory.mock.mockHeaders['X-Tag']).toBe('root'); factory.mock.mockFlush(200, 'OK', '{}'); } finally { child.destroy(); } });

Maybe the issue here is that we allow this contradictory usage. Both withRequestsMadeViaParent() and withXhr() register a different backend.

I thought that could be the case too; in fact, I don't know if it's intentional or not.

But I think a feature on some route might want to use withXhr while maintaining interceptors for the upload report, which isn't supported in fetch.

Both provide HttpBackend only the latest registred will effectively be injected.

My bad , you're right, we'll most likely have to throw an exception in this case.

Updated, we will now throw an exception at development time, although I still think we should allow a custom HttpBackend for example in provideHttpClientTesting

JeanMeche · 2026-07-21T21:26:24Z

Found a regression/change:
Prior to this change the interceptor would run twice, now it only runs ones.

import { TestBed } from '@angular/core/testing';
import { EnvironmentInjector, createEnvironmentInjector } from '@angular/core';
import { HttpClient, provideHttpClient, withRequestsMadeViaParent } from '@angular/common/http';
import { HttpTestingController, provideHttpClientTesting } from '@angular/common/http/testing';
import { HTTP_ROOT_INTERCEPTOR_FNS } from '@angular/common/http/src/interceptor';
describe('Delegating HttpClient root interceptors', () => {
  it('should only run root interceptors once in a delegated chain', () => {
    let rootInterceptorRunCount = 0;
    TestBed.configureTestingModule({
      providers: [
        provideHttpClient(),
        provideHttpClientTesting(),
        {
          provide: HTTP_ROOT_INTERCEPTOR_FNS,
          multi: true,
          useValue: (req, next) => {
            rootInterceptorRunCount++;
            return next(req);
          }
        }
      ],
    });
    const childInjector = createEnvironmentInjector(
      [provideHttpClient(withRequestsMadeViaParent())],
      TestBed.inject(EnvironmentInjector)
    );
    const client = childInjector.get(HttpClient);
    const httpMock = TestBed.inject(HttpTestingController);
    client.get('/api/data').subscribe();
    httpMock.expectOne('/api/data').flush({});
    // ❌ FAILS BEFORE PR: The count would be 2 because the child executed the parent's 
    // root interceptors, and then the parent executed them again.
    expect(rootInterceptorRunCount).toBe(1); 
  });
});

SkyZeroZx · 2026-07-21T22:02:07Z

Found a regression/change: Prior to this change the interceptor would run twice, now it only runs ones.

import { TestBed } from '@angular/core/testing';
import { EnvironmentInjector, createEnvironmentInjector } from '@angular/core';
import { HttpClient, provideHttpClient, withRequestsMadeViaParent } from '@angular/common/http';
import { HttpTestingController, provideHttpClientTesting } from '@angular/common/http/testing';
import { HTTP_ROOT_INTERCEPTOR_FNS } from '@angular/common/http/src/interceptor';
describe('Delegating HttpClient root interceptors', () => {
  it('should only run root interceptors once in a delegated chain', () => {
    let rootInterceptorRunCount = 0;
    TestBed.configureTestingModule({
      providers: [
        provideHttpClient(),
        provideHttpClientTesting(),
        {
          provide: HTTP_ROOT_INTERCEPTOR_FNS,
          multi: true,
          useValue: (req, next) => {
            rootInterceptorRunCount++;
            return next(req);
          }
        }
      ],
    });
    const childInjector = createEnvironmentInjector(
      [provideHttpClient(withRequestsMadeViaParent())],
      TestBed.inject(EnvironmentInjector)
    );
    const client = childInjector.get(HttpClient);
    const httpMock = TestBed.inject(HttpTestingController);
    client.get('/api/data').subscribe();
    httpMock.expectOne('/api/data').flush({});
    // ❌ FAILS BEFORE PR: The count would be 2 because the child executed the parent's 
    // root interceptors, and then the parent executed them again.
    expect(rootInterceptorRunCount).toBe(1); 
  });
});

In fact, I believe it was a bug and not something expected to happen twice (or so I think), since that's why the problem described in #69777 occurs.

I doubt we would expect or that it would make any sense to expect an interceptor to execute twice (when you create an interceptor in an app, this doesn't happen).

JeanMeche

AGENT: Great PR! The tests are very thorough and it effectively fixes the duplicate root interceptor execution. I have left a few inline suggestions for your consideration to simplify the implementation by removing the internal injection token.

JeanMeche · 2026-07-22T09:44:22Z

 }

+/** Indicates that the current `HttpClient` delegates requests to its parent. */
+export const ɵHTTP_CLIENT_IS_DELEGATING = new InjectionToken<boolean>(


AGENT: If you apply the suggestion below to check the handler directly, this token and its provider can be safely removed.

JeanMeche · 2026-07-22T09:44:23Z


  handle(initialRequest: HttpRequest<any>): Observable<HttpEvent<any>> {
    if (this.chain === null) {
+      const isDelegating = this.injector.get(ɵHTTP_CLIENT_IS_DELEGATING, false, {self: true});


AGENT: We can simplify this logic by checking if this.backend is the parent HttpHandler directly. This allows us to completely remove the ɵHTTP_CLIENT_IS_DELEGATING token and its associated provider in provider.ts, keeping the API surface smaller and saving a provider initialization.

Suggested change

const isDelegating = this.injector.get(ɵHTTP_CLIENT_IS_DELEGATING, false, {self: true});

const parentHandler = this.injector.get(HttpHandler, null, {skipSelf: true});

const isDelegating = parentHandler !== null && this.backend === parentHandler;

JeanMeche · 2026-07-22T09:44:23Z

    },
+    {
+      provide: ɵHTTP_CLIENT_IS_DELEGATING,
+      // `HttpBackend` can be overridden by later providers, so derive this flag from the


AGENT: If we evaluate the delegation condition directly in HttpInterceptorHandler.handle, this provider can be removed.

Represent withRequestsMadeViaParent() with an internal delegating backend so the interceptor handler can distinguish delegated clients from independent child configurations. Delegated clients leave inherited root interceptors to the parent chain. This prevents duplicate execution and lets HttpTransferCache evaluate authentication and cache filters after parent request interceptors, while independent child clients continue to inherit framework root interceptors. Add coverage for independent root inheritance, request and response ordering, authenticated requests, cache filters, and public cache hits. Fixes angular#69777

pullapprove Bot requested a review from JeanMeche July 15, 2026 05:00

angular-robot Bot added the area: common/http Issues related to HTTP and HTTP Client label Jul 15, 2026

ngbot Bot added this to the Backlog milestone Jul 15, 2026

JeanMeche reviewed Jul 15, 2026

View reviewed changes

SkyZeroZx requested a review from JeanMeche July 16, 2026 15:30

JeanMeche requested review from alan-agius4 and removed request for JeanMeche July 17, 2026 15:38

alan-agius4 approved these changes Jul 20, 2026

View reviewed changes

alan-agius4 added the action: cleanup The PR is in need of cleanup, either due to needing a rebase or in response to comments from reviews label Jul 20, 2026

SkyZeroZx force-pushed the fix/leak-parent-transfercache branch 2 times, most recently from 449ce42 to 26df123 Compare July 20, 2026 16:56

SkyZeroZx requested a review from JeanMeche July 20, 2026 18:50

JeanMeche reviewed Jul 22, 2026

View reviewed changes

SkyZeroZx added 4 commits July 22, 2026 09:33

fixup! fix(http): run root interceptors in the terminal request chain

2e1ce8d

fixup! fix(http): run root interceptors in the terminal request chain

b1f5851

fixup! fix(http): run root interceptors in the terminal request chain

51616ee

SkyZeroZx force-pushed the fix/leak-parent-transfercache branch from cb9fbd6 to 51616ee Compare July 22, 2026 14:33

	const isDelegating = this.injector.get(ɵHTTP_CLIENT_IS_DELEGATING, false, {self: true});
	const parentHandler = this.injector.get(HttpHandler, null, {skipSelf: true});
	const isDelegating = parentHandler !== null && this.backend === parentHandler;

Uh oh!

Conversation

SkyZeroZx commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

SkyZeroZx Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

JeanMeche Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

SkyZeroZx Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

SkyZeroZx Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

JeanMeche commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

SkyZeroZx commented Jul 21, 2026

Uh oh!

JeanMeche left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

SkyZeroZx commented Jul 15, 2026 •

edited

Loading

SkyZeroZx Jul 15, 2026 •

edited

Loading

JeanMeche Jul 17, 2026 •

edited

Loading

SkyZeroZx Jul 17, 2026 •

edited

Loading

SkyZeroZx Jul 17, 2026 •

edited

Loading

JeanMeche commented Jul 21, 2026 •

edited

Loading