---
schema_version: "1"
id: 29fdd950e1efedfb031ad23707d893d916d9036378d24e2deae85efc538a88fb
title: Use Blob Objects for Download Links
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/lwc/lightning-components-security/guides/lws/lws-blob-download.md
canonical_url: https://developer.salesforce.com/docs/platform/lightning-components-security/guide/lws-blob-download.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 6d69b3d846921c193754744e21aa6a50d5f692d7c2e91032a46cccd8908d04a0
products:
  - Security for Lightning Components
  - lwc
---
# Use Blob Objects for Download Links

Lightning Web Security (LWS) blocks the use of `data:` URIs in anchor links because that approach has various security issues. Use a `blob:` URI instead.

This example shows an approach to creating a dynamic plain text file download link that uses a `data:` URI. This approach requires allowing `data:` URIs generally, which is insecure.

```javascript
// EXAMPLE OF INSECURE DOWNLOAD LINK
// This technique is prevented by LWS
const textEncoded = `data:text/plain,${encodeURIComponent( 'text string' )}`;
let anchorTag = document.createElement('a');
anchorTag.setAttribute('href', textEncoded);
anchorTag.setAttribute('download', 'nameoffile.crt');
anchorTag.click();
```

Instead, create a `Blob` to hold the data, and use the `blob:` URL scheme to make it available for download.

```javascript
const blob = new Blob(['text string'], { type: 'text/plain' });
const blobUrl = URL.createObjectURL(blob);
const anchorTag = document.createElement('a');
anchorTag.setAttribute('href', blobUrl);
anchorTag.setAttribute('download', 'nameoffile.crt');
anchorTag.click();
URL.revokeObjectURL(blobUrl);
```

`data:` URIs embed content directly inline as a URL. This creates several security risks that LWS blocks. A `blob:` URL is bound to the origin that created it — it inherits the page’s origin, and is subject to same-origin policy. This and other attributes make `blob:` a controlled, auditable mechanism for a legitimate use case (file downloads) without the open-ended risks of `data:`.