---
title: "HTTP, resources, interceptors, and API contracts"
chapter: "08"
---

# HTTP, resources, interceptors, and API contracts

HttpClient is Angular's typed transport API. Type parameters describe expected
data; they do not validate responses.

## Read paths

Use `httpResource` for signal-oriented reactive reads and HttpClient Observables
for explicit composition. Resources are eager when their parameters are valid;
HttpClient Observables are cold and request on subscription.

## Mutations

Commands such as create, approve, and delete need explicit lifecycle:
idle, submitting, success, validation conflict, authorization failure, network
failure, and retry policy. Do not hide all failures behind “Something went
wrong.”

## Functional interceptors

Interceptors handle cross-cutting transport concerns: credentials, correlation,
approved retry, timing, and error translation. Keep business decisions in
application workflows.

## Authentication

Prefer secure, short-lived identity. If using cookies, design CSRF protection.
If using bearer tokens, avoid unsafe persistent storage and defend against XSS.
The backend validates identity, audience, expiry, and authorization.

## Cancellation and timeouts

Navigation, changing resource parameters, or destroying an owner should cancel
obsolete work. Apply timeouts according to user action and backend contract.

## Runtime validation

Validate critical remote data at the boundary. Map DTOs into domain/view models.
Never render server-provided HTML without a reviewed sanitization contract.

## Feynman check

The generic in `http.get<Order>()` is a promise you make to the compiler. It is
not proof about bytes from the network. Explain where that proof occurs.