I was wondering if you guys have an idea of vulnerabilities for URL params when used in lightning.

I've tried Cross-Site Request Forgery against the app and its been safe. We also have a URL Whitelist to cross reference safe URLs that we expect to be navigate to.

Cheers, T

1 Answer 1


For a Lightning App, public/global attributes can be set by a query string. When possible, make attributes private. Mind you, this is a feature, for when you expect information from an external source. Just be prepared to validate all values and check CRUD/FLS if applicable. As long as you make no assumptions about security or validity of the attribute values, you should be fine. For Lightning Components, there's no URL you can produce that would inject an attribute into the component.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .