15

On the Release Update page in the setup (/lightning/setup/ReleaseUpdates/home) I found this

Enable Secure Static Resources for Lightning Components COMPLETE STEPS BY: 29.11.2020 TEST RUN SUPPORTED To improve security, this update serves all static resources from the Visualforce domain instead of the Lightning domain.

What is changing?

To improve security, this update serves all static resources from the Visualforce domain instead of the Lightning domain. This change affects Aura and Lightning web components. We recommend that you test this update in a sandbox org to verify correct behavior before enabling it in your production org.

What improvements can I see?

This update improves security by serving static resource from the Visualforce domain instead of the lightning domain. This change prevents a script included in a static resource from accessing the document in the lightning domain due to the same-origin security policy.

How is my org impacted?

This update serves static resources from the Visualforce domain instead of the lightning domain. A script included in a static resources can’t access the document in the lightning domain due to the same-origin security policy.

The crucial part here is "can't" access the document. My first reflex is to assume the word document means DOM (Document Object Model). Salesforce has done a lot to make it hard to access the DOM in the past because of security concerns. Central point is their locker service. To some degree I understand that, but in most parts an accessible DOM is the only ticket to use JS frameworks and existing powerful HTML/JS components, like charts, UI elements and 3D visualization tools.

We have several Aura Components using API Version 36.0 to avoid locker service. Also we use a lot of jQuery and other JS-Libraries to access the DOM. These are for instance

Does this "security update" mean, that all our Aura Components will break on 2020-11-29?

If this would be the case, I also can not see any workaround to prevent it.

Does it mean, that we are forced back to Vanilla JavaScript an the few libraries, which are allowed by Salesforce?

6
  • The Update "Enable Secure Static Resources for Lightning Components" causes a CORS issue for static resources loaded from an aura component. See the known issue trailblazer.salesforce.com/issues_view?id=a1p4V000001JipTQAS – Swetha Oct 20 '20 at 11:24
  • For those who are using Aura or LWC, but have no idea if this is going to affect them, the relevant part of the Release Notes is here: releasenotes.docs.salesforce.com/en-us/winter21/release-notes/… It has some pointers to guides on the use of resources. A scan of your code for resource or $resource will give a quick indication of whether this update afects you. – Sander de Jong Oct 21 '20 at 11:05
  • Does this mean we can't use static resource scripts at all in either Aura or LWC components? In that case, why is the name of this "feature" Secure Static Resources instead of Prohibition of Static Resources? Does this apply even if loadScript is used? Is Salesforce really saying I cannot provide any external scripts via static resources? – kamezaburo Oct 23 '20 at 4:59
  • We are told that "This update serves static resources from the Visualforce domain instead of the lightning domain. A script included in a static resources can’t access the document in the lightning domain due to the same-origin security policy." However, as I read one of the examples created, it seems that the script won't be able to be loaded at all. I wonder which it is. – kamezaburo Oct 23 '20 at 20:12
  • This update is postponed to Summer ’21. It was scheduled for auto-activation (enforcement) in Spring ’21. Does this release notes answer any of your questions? releasenotes.docs.salesforce.com/en-us/winter21/release-notes/… – Anudeep Gopagoni Oct 27 '20 at 16:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.