Free tools Windows power users keep installed
One-click scans. No signup required.
NG05201 means Angular found an untrusted value in a resource URL context, such as an iframe’s src. Trace the value to its source. If your application fully controls the resource URL, Angular documents an explicit trust assertion; if it comes from a user or another uncontrolled source, do not bypass the check.
What NG05201 means
Angular raises NG05201 when an untrusted value is bound to an attribute that can load an external resource. Unlike a regular URL, a resource URL can cause the browser to fetch and execute external content. Angular therefore cannot make an arbitrary resource URL safe simply by sanitizing it. Its NG05201 error reference lists these resource URL contexts:
As an Amazon Associate I earn from qualifying purchases.
<base href><embed src><frame src><iframe src><link href><object codebase>and<object data>
A common example is an iframe binding such as <iframe [src]="userUrl"></iframe>. The problem is not necessarily the URL’s format; it is that Angular has no basis for treating the value as safe for loading a resource.
Where to look for the unsafe value
Check resource URL bindings
Search templates for bindings to the attributes above. Follow the bound expression back through component properties, services, route parameters, API responses, and user input until you know who controls the value. The relevant question is whether the application itself fixes and controls the URL, not merely whether it looks familiar.
#1 Best Overall
Check direct sanitizer calls
Also inspect calls to DomSanitizer.sanitize() that use SecurityContext.RESOURCE_URL. Angular’s DomSanitizer documentation explains this API; the NG05201 reference shows that passing a plain string (including an https:// URL) in this context throws the error. A string does not become trusted just because it uses HTTPS.
Choose a fix based on who controls the URL
For a resource URL fully controlled by your application
If the URL is fixed or otherwise fully controlled by your application, Angular documents DomSanitizer.bypassSecurityTrustResourceUrl() as an escape hatch for asserting that trust. It returns a SafeResourceUrl that can be used in the resource URL binding. For example:
import { DomSanitizer, SafeResourceUrl } from '@angular/platform-browser';
export class EmbedComponent {
trustedUrl: SafeResourceUrl;
constructor(sanitizer: DomSanitizer) {
this.trustedUrl = sanitizer.bypassSecurityTrustResourceUrl(
'https://example.com/embed'
);
}
}Then bind the trusted value to the resource attribute:
<iframe [src]="trustedUrl"></iframe>This method asserts that the supplied value is trusted; it does not sanitize or validate the URL. Keep the trust decision close to the application-controlled value so that untrusted data cannot flow into the call.
Rank #3
For user-supplied or otherwise uncontrolled URLs
Do not pass a URL from a user, API, or other uncontrolled source to bypassSecurityTrustResourceUrl(). Angular warns that doing so can let an attacker load arbitrary content, including malicious scripts. Do not treat a scheme check or the appearance of a known domain as a substitute for controlling the value.
If the destination only needs to be an ordinary navigable URL rather than a resource loaded into the page, use the appropriate regular URL attribute and let Angular apply its normal URL sanitization. A resource URL and a regular URL have different security contexts; changing to a regular URL is appropriate only when it fits the intended behavior.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verify the correction
- Confirm the binding or sanitizer call that produced the error and identify the value’s actual origin.
- For a resource URL, ensure only an application-controlled value reaches the trust-bypass call.
- For uncontrolled input, remove the bypass rather than suppressing the error; choose a design that does not load that input as a resource.
- Re-run the affected view and confirm the intended resource loads without accepting arbitrary user-provided resource URLs.
The official error reference was accessed on October 7, 2026, and identifies its rendered documentation as Angular v22.2.1 (build fa63bfa). It gives no publication date; check the current Angular documentation if using a later release.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
