# URL Protocol Schemes Allowed

Lightning Web Security (LWS) restricts the [`HTMLObjectElement.data`](https://developer.mozilla.org/en-US/docs/Web/API/HTMLObjectElement/data) attribute and the `src` attribute for `iframe` elements to values that use the `http://` and `https://` schemes. URL schemes like `javascript://` aren’t allowed.

**See Also**

- [Use Blob Objects for Download Links](/docs/platform/lightning-components-security/guide/lws-blob-download.md)

- [HTMLObjectElement.data in LWS Distortion Viewer](https://developer.salesforce.com/docs/component-library/tools/lws-distortion-viewer#HTMLObjectElement_data-setter)

- [HTMLIFrameElement.src in LWS Distortion Viewer](https://developer.salesforce.com/docs/component-library/tools/lws-distortion-viewer#HTMLIFrameElement_src-setter)