---
schema_version: "1"
id: 906f629112dfd154f9f042aa26742a40026c3f1b33cb4a702a5f0fd4634fe2d5
title: URL Protocol Schemes Allowed
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/lwc/lightning-components-security/guides/lws/lws-url-schemes.md
canonical_url: https://developer.salesforce.com/docs/platform/lightning-components-security/guide/lws-url-schemes.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 0e550e6451b485c4954eb9e5e33a9e82df7e2dda2191ecb4a819bfb37af7a9d6
products:
  - Security for Lightning Components
  - lwc
---
# URL Protocol Schemes Allowed

Lightning Web Security (LWS) restricts the [`HTMLObjectElement.data`](https://developer.mozilla.org/en-US/docs/Web/API/HTMLObjectElement/data) attribute and the `src` attribute for `iframe` elements to values that use the `http://` and `https://` schemes. URL schemes like `javascript://` aren’t allowed.

**See Also**

- [Use Blob Objects for Download Links](https://developer.salesforce.com/docs/platform/lightning-components-security/guide/lws-blob-download.md)

- [HTMLObjectElement.data in LWS Distortion Viewer](https://developer.salesforce.com/docs/component-library/tools/lws-distortion-viewer#HTMLObjectElement_data-setter)

- [HTMLIFrameElement.src in LWS Distortion Viewer](https://developer.salesforce.com/docs/component-library/tools/lws-distortion-viewer#HTMLIFrameElement_src-setter)