Unsafe value used in a resource URL context

Angular throws this error, with the message unsafe value used in a resource URL context, when a template or host binding sets an attribute that loads an external resource — like <iframe src> or <link href> — to a value that hasn't been explicitly marked as trusted.

Resource URLs are treated differently from regular URLs. Angular can sanitize a plain URL, but it can't make an arbitrary resource URL safe because these attributes cause the browser to fetch and execute external content. So Angular rejects untrusted values rather than trying to sanitize them.

The attributes that trigger this check are:

Debugging the error

The error is thrown when any plain string is bound to one of the attributes above, even a static-looking URL:

@Component({
  selector: 'app-root',
  template: `<iframe [src]="url"></iframe>`,
})
export class App {
  url = 'https://example.com/embed';
}

Passing the value through DomSanitizer.sanitize() with SecurityContext.URL does not help. sanitize() returns a plain string, and a plain string is never accepted in a resource URL context:

@Component({
  selector: 'app-root',
  template: `<iframe [src]="sanitized"></iframe>`,
})
export class App {
  private readonly sanitizer = inject(DomSanitizer);
  sanitized = this.sanitizer.sanitize(SecurityContext.URL, 'https://example.com/embed'); // still throws NG0904
}

Calling sanitize() with SecurityContext.RESOURCE_URL instead throws too, but with NG05201, because sanitize() cannot make an arbitrary string safe in a resource URL context.

If the URL comes from a trusted, controlled source, mark it safe using DomSanitizer.bypassSecurityTrustResourceUrl:

import {DomSanitizer, SafeResourceUrl} from '@angular/platform-browser';

@Component({
  selector: 'app-root',
  template: `<iframe [src]="safeUrl"></iframe>`,
})
export class App {
  safeUrl: SafeResourceUrl = inject(DomSanitizer).bypassSecurityTrustResourceUrl(
    'https://example.com/embed',
  );
}

For more information, see the Security guide.