URL Protocol Schemes Allowed

Lightning Web Security (LWS) restricts the HTMLObjectElement.data attribute and the src attribute for iframe elements to values that use the http:// and https:// schemes. URL schemes like javascript:// aren’t allowed.

See Also

Release Preview

This release is in preview. Features described here don't become generally available until the latest general availability date that Salesforce announces for this release. Before then, and where features are noted as beta, pilot, or developer preview, we can't guarantee general availability within any particular time frame or at all. Make your purchase decisions only on the basis of generally available products and features.

Get Started
Lightning Web Security (LWS)
How LWS Works
Determine if LWS Affects Your Org
When to Enable LWS
Enable LWS in an Org
Enable and Disable LWS in Scratch Orgs
Workflow to Test Your Components with LWS
Tools for LWS
Considerations Before Using LWS-Only Features
Experience Builder Sites and LWS
Build Components to Work With LWS
Avoid Mutating Objects
Avoid Using Map Objects
Avoid Custom Properties on Standard JavaScript Objects
Specify a MIME Type for Blob Objects
Use Blob Objects for Download Links
Script Tags Transformed to Fetch Calls
Access to iframe Content in LWS
URL Protocol Schemes Allowed
Aura Endpoints Disallowed by LWS
Analytics Libraries Blocked by LWS
Salesforce Global Variables Blocked by LWS
Third-Party Library Considerations for LWS
Local Storage Limitations
Objects Passed Between Components Are Proxied
Programmatic Click to Open Same-Origin URLs
Understand How LWS Architecture Affects Component Performance
Debug with LWS Enabled
LWS Sanitization
Troubleshoot Issues Related to LWS
LWS Limitations
Lightning Locker
Content Security Policy (CSP)
JavaScript Strict Mode Enforcement