HTMLAnchorElement Distortion Blocks data: URI Scheme

The new distortion on HTMLAnchorElement.prototype.href blocks URLs that use the data: URI scheme. The data: URI scheme can be used to create plain text download links, but that approach raises various security issues. Use the blob: URI scheme instead.

Important : This distortion is not enforced in Summer '26 release, but will be in Winter '27 release.

Where: This change applies to Lightning Experience, LWR-based Experience Cloud sites, and Lightning web components in Aura sites when Lightning Web Security (LWS) is enabled.

Why: data: URIs embed content directly inline as a URL. This creates several security risks that LWS blocks.

A blob: URL is bound to the origin that created it — it inherits the page’s origin, and is subject to same-origin policy. This and other attributes make blob: a controlled, auditable mechanism for a legitimate use case (file downloads) without the open-ended risks of data:.

How: This example shows an approach to creating a dynamic file download link that uses a data: URI. This approach requires enabling data: URIs generally, which is insecure, as described the preceding section.

// EXAMPLE OF INSECURE DOWNLOAD LINK
// This technique is prevented by LWS
const textEncoded = `data:text/plain,${encodeURIComponent(
  'text string'
)}`;
let anchorTag = document.createElement('a');
anchorTag.setAttribute('href', textEncoded);
anchorTag.setAttribute('download', 'nameoffile.crt');
anchorTag.click();

Instead, create a Blob to hold the data, and use the blob: URI scheme to make it available for download.

const blob = new Blob(['text string'], { type: 'text/plain' });
const blobUrl = URL.createObjectURL(blob);
const anchorTag = document.createElement('a');
anchorTag.setAttribute('href', blobUrl);
anchorTag.setAttribute('download', 'nameoffile.crt');
anchorTag.click();
URL.revokeObjectURL(blobUrl);