---
schema_version: "1"
id: 9c388916c038847515304393444fbc4aa81a41827e8df5c4d3fb00e5a138ce19
title: Programmatic Click to Open Same-Origin URLs
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/lwc/lightning-components-security/guides/lws/lws-prog-click.md
canonical_url: https://developer.salesforce.com/docs/platform/lightning-components-security/guide/lws-prog-click.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: b4e6b324bd9a99e8420575b41486a8861023daf42bdbb3ee6b61ad3571ce5ac1
products:
  - Security for Lightning Components
  - lwc
---
# Programmatic Click to Open Same-Origin URLs

In Spring '27 and later, when Lightning Web Security (LWS) is enabled, opening same-origin Salesforce URLs in a new tab by using `window.open(URL)` or `window.open(URL, '_blank')` results in a `LockerSecurityError`. Use this recommended programmatic anchor click for same-origin downloads and navigation.

```
const a = document.createElement('a');
a.href = url;              // /apex/... clears the href denylist
a.target = '_blank';       // or omit for same-tab
a.rel = 'noopener noreferrer';
a.click();                 // keep it detached; do NOT append to body/head
```

### Navigate in the Same Tab

To navigate in the same tab, set the target to `a.target= '_top'`, `a.target= '_self'`, or `a.target= '_parent'`. For example, a link on the homepage takes the user directly to a record.
Alternatively, you can use `window.open(url, '_top')`.

**important:** Using `window.open(URL)` without a target defaults to `_blank`, which in turn results in the `LockerSecurityError` error.