| 34 | // and start the process once the global scope is established by the underlying |
| 35 | // server platform (via shims, etc). |
| 36 | private async ɵloadImpl(): Promise<void> { |
| 37 | if (!this.xhrImpl) { |
| 38 | if (typeof ngDevMode === 'undefined' || ngDevMode) { |
| 39 | console.warn( |
| 40 | 'XHR support in `@angular/platform-server` is deprecated and will be removed ' + |
| 41 | 'in Angular 23. It has known security and performance issues in server ' + |
| 42 | 'environments, such as forwarding `Authorization` headers on cross-origin ' + |
| 43 | 'redirects and susceptibility to denial-of-service (DoS) via redirect loops. ' + |
| 44 | 'Please use the HttpClient fetch backend instead, which is the default since Angular 22.', |
| 45 | ); |
| 46 | } |
| 47 | |
| 48 | const {default: xhr} = await import('xhr2'); |
| 49 | this.xhrImpl = xhr; |
| 50 | } |
| 51 | } |
| 52 | |
| 53 | build(): XMLHttpRequest { |
| 54 | const impl = this.xhrImpl; |