Which @angular/* package(s) are the source of the bug?

common

Is this a regression?

No

Description

In SSR TransferCache when a child HttpClient useswithRequestsMadeViaParent().

The child request starts without authentication. A parent interceptor then adds a server-only Authorization header before sending it to an internal API. The request passes through two TransferCache interceptors:

child `HttpClient`
  -> child `TransferCache` sees an anonymous request
  -> parent authentication interceptor adds `Authorization`
  -> parent `TransferCache` sees the authenticated request and skips it
  -> backend returns a private response
  -> child TransferCache stores that response

The child TransferCache decides that the request is safe before the parent adds authentication, but it later receives the response produced by the authenticated request. That response is then written to TransferState and included in the SSR HTML.

The same thing happens with a custom filter.
Eg: If the parent adds X-API-KEY, this filter is evaluated once before the header exists and once after it exists:

withHttpTransferCacheOptions({
  filter: (request) => !request.headers.has('X-API-KEY'),
});

The parent TransferCache skips the request, but the child TransferCache still stores the response.

Expected behavior

TransferCache should evaluate the final request after the parent interceptors have run. If that request is authenticated or rejected by the configured filter, the response should not be added to TransferState.

Actual behavior

The authenticated response is stored using the decision made from the original anonymous child request.