@angular/ssr 22.0.0-next.6 → 22.0.0-next.8

package/types/_app-engine-chunk.d.ts

@@ -67,6 +67,24 @@ interface AngularAppEngineOptions {
      * A set of allowed hostnames for the server application.
      */
     allowedHosts?: readonly string[];
+    /**
+     * Extends the scope of trusted proxy headers (`X-Forwarded-*`).
+     *
+     * @remarks
+     * **This is a security-sensitive option!**
+     *
+     * When `trustProxyHeaders` is enabled, request headers such as `X-Forwarded-Host` and
+     * `X-Forwarded-Prefix` are trusted by the server and used for routing. These
+     * headers must be strictly validated and provided by a trusted client (e.g., at a reverse proxy, load
+     * balancer, or API gateway) and must *not* be provided by untrusted end users.
+     *
+     * If a `string[]` is provided, only those proxy headers are allowed.
+     * If `true`, all proxy headers are allowed.
+     * If `false` or not provided, proxy headers are ignored.
+     *
+     * @default false
+     */
+    trustProxyHeaders?: boolean | readonly string[];
 }
 /**
  * Angular server application engine.
@@ -114,6 +132,10 @@ declare class AngularAppEngine {
      * A map of supported locales from the server application's manifest.
      */
     private readonly supportedLocales;
+    /**
+     * The normalized allowed proxy headers.
+     */
+    private readonly trustProxyHeaders;
     /**
      * A cache that holds entry points, keyed by their potential locale string.
      */

package/types/node.d.ts

@@ -4,6 +4,10 @@ import { IncomingMessage, ServerResponse } from 'node:http';
 import { Http2ServerRequest, Http2ServerResponse } from 'node:http2';
 import { AngularAppEngineOptions } from './_app-engine-chunk.js';
 
+/**
+ * @deprecated Use `AngularNodeAppEngine` or `AngularAppEngine` instead.
+ * Deprecated since v22.
+ */
 interface CommonEngineOptions {
     /** A method that when invoked returns a promise that returns an `ApplicationRef` instance once resolved or an NgModule. */
     bootstrap?: Type<{}> | ((context: BootstrapContext) => Promise<ApplicationRef>);
@@ -14,6 +18,10 @@ interface CommonEngineOptions {
     /** A set of hostnames that are allowed to access the server. */
     allowedHosts?: readonly string[];
 }
+/**
+ * @deprecated Use `AngularNodeAppEngine` or `AngularAppEngine` instead.
+ * Deprecated since v22.
+ */
 interface CommonEngineRenderOptions {
     /** A method that when invoked returns a promise that returns an `ApplicationRef` instance once resolved or an NgModule. */
     bootstrap?: Type<{}> | ((context: BootstrapContext) => Promise<ApplicationRef>);
@@ -35,6 +43,9 @@ interface CommonEngineRenderOptions {
 }
 /**
  * A common engine to use to server render an application.
+ *
+ * @deprecated Use `AngularNodeAppEngine` or `AngularAppEngine` instead.
+ * Deprecated since v22.
  */
 declare class CommonEngine {
     private options?;
@@ -70,6 +81,7 @@ interface AngularNodeAppEngineOptions extends AngularAppEngineOptions {
  */
 declare class AngularNodeAppEngine {
     private readonly angularAppEngine;
+    private readonly trustProxyHeaders?;
     /**
      * Creates a new instance of the Angular Node.js server application engine.
      * @param options Options for the Angular Node.js server application engine.
@@ -180,9 +192,16 @@ declare function writeResponseToNodeResponse(source: Response, destination: Serv
  * be used by web platform APIs.
  *
  * @param nodeRequest - The Node.js request object (`IncomingMessage` or `Http2ServerRequest`) to convert.
+ * @param trustProxyHeaders - A boolean or an array of proxy headers to trust when constructing the request URL.
+ *
+ * @remarks
+ * When `trustProxyHeaders` is enabled, headers such as `X-Forwarded-Host` and
+ * `X-Forwarded-Prefix` should ideally be strictly validated at a higher infrastructure
+ * level (e.g., at the reverse proxy or API gateway) before reaching the application.
+ *
  * @returns A Web Standard `Request` object.
  */
-declare function createWebRequestFromNodeRequest(nodeRequest: IncomingMessage | Http2ServerRequest): Request;
+declare function createWebRequestFromNodeRequest(nodeRequest: IncomingMessage | Http2ServerRequest, trustProxyHeaders?: boolean | readonly string[]): Request;
 
 /**
  * Determines whether the provided URL represents the main entry point module.