Is opening desktop app using custom url protocol (url scheme) safe and won't be blocked by Salesforce?

Question

So I have requirement to open desktop app through salesforce. I created registry entry which is custom url protocol (details here) and simple component which is essentially a link.

<aura:component implements="flexipage:availableForRecordHome,force:hasRecordId" access="global" >
    <a href="test://">link</a>
</aura:component>

aaand it worked. I was able to open executable file.

But I'm slightly worried that it can be somehow blocked by Salesforce or generally it's not good idea (it is not I know, but it would be used only in specific business environment).

Should I be worried about anything?

Answer 1

There's nothing wrong with this approach. Your custom protocol is no different than mailto: or ftp:. There's also a tradition of making a custom protocol for your application so that you can craft URIs that open into the app (Spotify and Slack come to mind for this).

I don't see Salesforce ever blocking this functionality because, in order to do that, they would need to prevent the URIs with these protocols from ever reaching the client.

Your approach is generally safe. I say generally because this application is only available to users in this Salesforce environment, they will need to have the program installed on their device and have their device configured to have these URIs open into the program, and their browser will ask them if they want to open a clicked link in the other application. All that considered, depending on the content of the URI, it may be possible to craft one that causes the application to open and do something the user doesn't intend (say through a cross site scripting attack).

Answer 2

While this normal approach which works fine with <a href=""> & while it used to work in the previous release, Be aware of the following issue -

Currently there seems to be an issue going around the redirection of custom url scheme's when using e.force.navigateToURL , lighting:navigation or window.open().

After 220.x release Chrome opens custom url scheme's intent:// as "about:blank" in a new tab or window, however this works fine in firefox & Edge.

The following use-cases seems to have a problem with custom url scheme's.

e.force.navigateToURL

$A.get('e.force:navigateToURL').setParams({url: 'customscheme://example/demo'}).fire(); 

lightning:navigation

var navService = component.find("navService");
var pageReference = {
    "type": "standard__webPage",
    "attributes": {
        "url": "helloworld://example/demo"
    }
};
navService.navigate(pageReference);

window.open()

window.open('tryme://helloworld/demo','_blank') // in browser console

Reference :

Known Issue Link : https://success.salesforce.com/issues_view?id=a1p3A000001YmiLQAS