Programmatic Click to Open Same-Origin URLs

In API version 68.0 and later, when Lightning Web Security (LWS) for Aura is enabled, using window.open() with _blank to open same-origin Salesforce URLs in a new tab results in a LockerSecurityError. For example, window.open(vfPdfUrl, '_blank', 'noopener,noreferrer') doesn’t work starting in API version 68.0. Use this recommended programmatic anchor click for same-origin downloads and navigation.

1const a = document.createElement('a');
2a.href = url;              // /apex/... clears the href denylist
3a.target = '_blank';       // or omit for same-tab
4a.rel = 'noopener noreferrer';
5a.click();                 // keep it detached; do NOT append to body/head