Interceptors apply cross-cutting request behavior. Requests are immutable containers, so clone when modifying headers or other supported fields.
Before you start
You should understand a component’s class, template and dependencies. Follow both the framework lifecycle and the ownership of each value or resource. Apply examples inside an Angular application; the surrounding application configuration and imports depend on the feature being demonstrated.
The practical goal is to reason through this situation: Add a correlation header with request.clone and forward the updated request. Read the walkthrough first, then try the interview exercise before opening its answer. The important part is explaining the decision and its consequences, rather than remembering a definition alone.
Step-by-step walkthrough
Step 1: Scope cross-cutting behavior
Determine which destinations may receive the header. Authentication must not be attached indiscriminately to arbitrary URLs.
Step 2: Clone supported request fields
Use request.clone for headers and forward the clone. The original request container remains unchanged.
Step 3: Avoid deep body mutation
Bodies can still contain mutable objects. Repeated interceptor execution must not accumulate changes or corrupt shared payloads.
Worked scenario
Add a correlation header with request.clone and forward the updated request.
An interceptor adds a correlation header with request.clone({ setHeaders: { 'X-Request-Id': id } }), then calls next with that clone. Credential attachment uses a separate explicit trusted-origin policy. Matching a URL by an unanchored substring is insufficient because an unrelated host could contain the expected text.
Common mistake
Mutating a shared request body can still leak changes because deep body immutability is not guaranteed.
Verify the behavior
Inspect trusted and untrusted destinations, retry behavior and shared request bodies. Verify headers do not leak across origins.
Interview exercise
Avoid leaking credentials across hosts.
Answer and reasoning
Check the destination and authentication policy before attaching credentials; do not assume every intercepted URL is trusted.
Continue learning
Compare the scenario with the Angular interview questions and test your understanding with the Angular MCQs. For terminology and implementation details, consult the reference material.