Angular SSR route-policy confusion can expose client-only data under public cache headers

Start by reproducing the mismatch with the two curl requests and the minimal ServerRoute configuration. Trace how Angular SSR selects renderMode and response headers for /profile; and how Angular Router renders /profile; and /profile//public. Done means the rendered body, renderMode, and cache headers always correspond to the same route, with no request-derived value exposed for the client-only route.

Description

Angular SSR can select server-route metadata from one route while Angular Router renders a different route when the request URL contains certain ambiguous path forms.

Example:

/profile;
/profile//public

In both cases, a route configured as RenderMode.Client can be unexpectedly rendered on the server while inheriting public cache headers from another ServerRoute.

Minimal Reproduction

Minimal configuration

import { RenderMode, ServerRoute } from '@angular/ssr';

export const serverRoutes: ServerRoute[] = [
  {
    path: 'profile',
    renderMode: RenderMode.Client,
    headers: {
      'Cache-Control': 'private, no-store',
    },
  },
  {
    path: 'profile/public',
    renderMode: RenderMode.Server,
    headers: {
      'Cache-Control': 'public, max-age=300',
    },
  },
  {
    path: '**',
    renderMode: RenderMode.Server,
    headers: {
      'Cache-Control': 'public, max-age=300',
    },
  },
];

The /profile component reads a benign request-derived marker through the SSR REQUEST token.

Steps to reproduce

Request the normal client-only route:

curl -i \
  -H 'Cookie: session=PRIVATE_VALUE' \
  http://localhost:4000/profile

The initial HTML does not contain the request-derived value.

Request either crafted path:

curl -i \
  -H 'Cookie: session=PRIVATE_VALUE' \
  'http://localhost:4000/profile;'

curl -i \
  -H 'Cookie: session=PRIVATE_VALUE' \
  http://localhost:4000/profile//public

Actual behavior

The crafted requests can:

• render the /profile component on the server;
• expose request-derived data in the initial HTML;
• apply Cache-Control: public metadata belonging to another server route.

Expected behavior

The route used to select renderMode, status, and response headers must always correspond to the route whose body is rendered.

A route configured as RenderMode.Client should not be server-rendered through an alternative URL representation.

Your Environment

Angular 22.X

Anything else relevant?

This was previously reported at https://issuetracker.google.com/u/1/issues/518988455