---
schema_version: "1"
id: 5e15bd55730a9adc35441bf80a017e7904430622646bfba579ce0bf6c1cf373c
title: "HTMLAnchorElement Distortion Blocks data: URI Scheme"
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/262-0-0/rn_lc_lws_htmlanchorelement_distortion.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_lc_lws_htmlanchorelement_distortion.htm&release=262.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: eb9b7e2d9d358b1e28b818931917c28d763144b70af7fbfb1b7d550241f94ac0
description: "The new distortion on HTMLAnchorElement.prototype.href blocks URLs that use the data: URI scheme. The data: URI scheme can be used to create plain text download links, but that approach raises various security issues. Use the blob: URI scheme instead."
products:
  - Cross Cloud
release: "262"
---
# `HTMLAnchorElement` Distortion Blocks `data:` URI Scheme

The new distortion on `HTMLAnchorElement.prototype.href` blocks URLs that use the `data:` URI scheme. The `data:` URI scheme can be used to create plain text download links, but that approach raises various security issues. Use the `blob:` URI scheme instead.

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-release-notes-salesforce_release_notes-262-0-0-production-enus/e945111b-3e0a-4011-accc-d5949363bfcc/images/icon_important.png)

Important : This distortion is not enforced in Summer '26 release, but will be in Winter '27 release.

**Where:** This change applies to Lightning Experience, LWR-based Experience Cloud sites, and Lightning web components in Aura sites when Lightning Web Security (LWS) is enabled.

**Why:** `data:` URIs embed content directly inline as a URL. This creates several security risks that LWS blocks.

A `blob:` URL is bound to the origin that created it — it inherits the page’s origin, and is subject to same-origin policy. This and other attributes make `blob:` a controlled, auditable mechanism for a legitimate use case (file downloads) without the open-ended risks of `data:`.

**How:** This example shows an approach to creating a dynamic file download link that uses a `data:` URI. This approach requires enabling `data:` URIs generally, which is insecure, as described the preceding section.

```
// EXAMPLE OF INSECURE DOWNLOAD LINK
// This technique is prevented by LWS
const textEncoded = `data:text/plain,${encodeURIComponent(
  'text string'
)}`;
let anchorTag = document.createElement('a');
anchorTag.setAttribute('href', textEncoded);
anchorTag.setAttribute('download', 'nameoffile.crt');
anchorTag.click();
```

Instead, create a `Blob` to hold the data, and use the `blob:` URI scheme to make it available for download.

```javascript
const blob = new Blob(['text string'], { type: 'text/plain' });
const blobUrl = URL.createObjectURL(blob);
const anchorTag = document.createElement('a');
anchorTag.setAttribute('href', blobUrl);
anchorTag.setAttribute('download', 'nameoffile.crt');
anchorTag.click();
URL.revokeObjectURL(blobUrl);
```