HTTP, resources, interceptors, and API contracts

HttpClient is Angular's typed transport API. Type parameters describe expected data; they do not validate responses.

Read paths

Use httpResource for signal-oriented reactive reads and HttpClient Observables for explicit composition. Resources are eager when their parameters are valid; HttpClient Observables are cold and request on subscription.

Mutations

Commands such as create, approve, and delete need explicit lifecycle: idle, submitting, success, validation conflict, authorization failure, network failure, and retry policy. Do not hide all failures behind “Something went wrong.”

Functional interceptors

Interceptors handle cross-cutting transport concerns: credentials, correlation, approved retry, timing, and error translation. Keep business decisions in application workflows.

Authentication

Prefer secure, short-lived identity. If using cookies, design CSRF protection. If using bearer tokens, avoid unsafe persistent storage and defend against XSS. The backend validates identity, audience, expiry, and authorization.

Cancellation and timeouts

Navigation, changing resource parameters, or destroying an owner should cancel obsolete work. Apply timeouts according to user action and backend contract.

Runtime validation

Validate critical remote data at the boundary. Map DTOs into domain/view models. Never render server-provided HTML without a reviewed sanitization contract.

Feynman check

The generic in http.get<Order>() is a promise you make to the compiler. It is not proof about bytes from the network. Explain where that proof occurs.