Build an Angular HTTP interceptor with correlation and safe retry rules

Implement a functional interceptor that adds an X-Correlation-ID when absent, records method, normalized route, duration, and outcome, and retries at most once only when the request opts in and the failure is transient. Do not retry unsafe commands by default, log secrets, or replace the original error.

GET /catalog + RETRY_SAFE=true + 503 -> one delayed retry
POST /orders + default context + 503  -> no retry
Authorization header                 -> never logged
failure after retry                  -> original error semantics preserved

• Use a functional interceptor and immutable request cloning.
• Make retry an explicit request-context decision.
• Retry only network, 502, 503, or 504 outcomes and at most once.
• Record a normalized route rather than the full query string.
• Preserve the error after telemetry and retry policy finish.

1. Define an HttpContextToken whose default is false.
2. Clone only when the correlation header is missing.
3. Capture start time and use retry configuration with a guarded delay function.
4. Record completion or error in finalize without reading sensitive headers or bodies.
5. Test opt-in, method safety, status filtering, request count, and unchanged error propagation.

import {HttpContextToken, HttpErrorResponse, HttpInterceptorFn} from '@angular/common/http';
import {inject} from '@angular/core';
import {retry, throwError, timer, finalize, tap} from 'rxjs';

export const RETRY_SAFE = new HttpContextToken<boolean>(() => false);

export const reliabilityInterceptor: HttpInterceptorFn = (request, next) => {
  const telemetry = inject(HttpTelemetry);
  const correlationId = request.headers.get('X-Correlation-ID') ?? crypto.randomUUID();
  const outgoing = request.headers.has('X-Correlation-ID')
    ? request
    : request.clone({setHeaders: {'X-Correlation-ID': correlationId}});
  const started = performance.now();
  let outcome = 'success';

  return next(outgoing).pipe(
    retry({
      count: request.context.get(RETRY_SAFE) && request.method === 'GET' ? 1 : 0,
      delay: error => {
        const transient = error instanceof HttpErrorResponse &&
          (error.status === 0 || [502, 503, 504].includes(error.status));
        if (!transient) return throwError(() => error);
        outcome = 'retried';
        return timer(200);
      },
    }),
    tap({error: () => { outcome = 'failure'; }}),
    finalize(() => telemetry.record({
      method: request.method,
      route: normalizeRoute(request.url),
      correlationId,
      outcome,
      durationMs: performance.now() - started,
    })),
  );
};

The interceptor adds O(1) client work per request. Retry can double one opted-in GET request, so downstream load remains explicitly bounded.

• A caller-supplied correlation ID is preserved.
• Status 400, 401, 403, 404, and validation failures are not retried.
• Cancellation still runs finalization and needs its own telemetry outcome in a full implementation.
• A route normalizer must avoid turning unique IDs or query values into high-cardinality labels.

• Verify a safe GET performs exactly two requests after one 503.
• Verify a POST with the same context still performs only one request.
• Verify a 400 is propagated immediately.
• Inspect telemetry and prove authorization, body, and raw query values are absent.

• Retrying every request can duplicate commands.
• Mutating the original request violates HttpClient immutability.
• Logging full URLs, headers, or bodies leaks sensitive and high-cardinality data.
• A broad catch that returns an empty response hides the failure from the feature.