I need to open dsfs__DocuSign_CreateEnvelope from Lightning controller. I tried to use e.force:navigateToURL component:

var urlEvent = $A.get("e.force:navigateToURL");
   "url": "/apex/dsfs__DocuSign_CreateEnvelope?DSEID=0&SourceID=" + cmp.get("v.recordId") +"&DST=" + dst + "&CRL=" + crl + "&CEM=" + cem,
   "isredirect": "true"

but I'm getting error The link you followed isn’t valid. This page requires a CSRF confirmation token. Report this error to your Salesforce administrator.. I found a page with this error on docusign website https://support.docusign.com/en/articles/DocuSign-for-Salesforce-7-0-This-page-requires-a-CSRF-confirmation-token and it says to use {!URLFOR} for Docusing 7.0+, but as I understand it only works for Visualforce pages. How can I do it in lightning?

2 Answers 2


You can construct the URL from Apex using PageReference class and then return the URL to the Lightning Component controller.


With CSRF being enabled on the Docusign managed package page (and I don't believe you can change it), there are three paths I've found to get around this: 1. You can get the free Docusign Lightning component from the AppExchange. This component (https://appexchange.salesforce.com/appxListingDetail?listingId=a0N3A00000EFmotUAD) allows you to access Docusign from a Lightning page; not sure if a custom controller can call it. Note there are limitations to this component (e.g., can't access from a custom object). 2. Docusign prescribes a method to call it from a custom URL using the URLFOR() function. This is well documented on their support pages (https://support.docusign.com/en/articles/DocuSign-for-Salesforce-7-0-This-page-requires-a-CSRF-confirmation-token). Not sure what your use case is, but I was able to combine this guidance with a Visual Flow and some simple IF logic in a custom URL button to equate to what I'd had in the Classic-supported javascript button. 3. It may be possible for your Lightning controller to call a VF page, which then calls Docusign. This was more intense than I needed, so I didn't explore this further. In any event, I'm not a Salesforce security expert, but my sense is client side code (e.g., custom Lightning components) are prevented from accessing those VF pages with CSRF protection enabled (I confirmed this with a custom VF page, which threw the same error when the checkbox was enabled).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.