Programmatic Click to Open Same-Origin URLs

In version Winter ‘27 and later, when Lightning Web Security (LWS) for Aura is enabled, opening same-origin Salesforce URLs in a new tab by using window.open(URL) with _blank results in a LockerSecurityError. For example, window.open(vfPdfUrl, '_blank', 'noopener,noreferrer') doesn’t work starting from Winter ‘27. Use this recommended programmatic anchor click for same-origin downloads and navigation.

1const a = document.createElement('a');
2a.href = url;              // /apex/... clears the href denylist
3a.target = '_blank';       // or omit for same-tab
4a.rel = 'noopener noreferrer';
5a.click();                 // keep it detached; do NOT append to body/head

Navigate in the Same Tab

To navigate in the same tab, set the target to a.target= '_top', a.target= '_self', or a.target= '_parent'. For example, a link on the homepage takes the user directly to a record. Alternatively, you can use window.open(url, '_top').

Using window.open(URL) without a target defaults to _blank, which in turn results in the LockerSecurityError error.

Important

Release Preview

This release is in preview. Features described here don't become generally available until the latest general availability date that Salesforce announces for this release. Before then, and where features are noted as beta, pilot, or developer preview, we can't guarantee general availability within any particular time frame or at all. Make your purchase decisions only on the basis of generally available products and features.