18

On the Release Update page in the setup (/lightning/setup/ReleaseUpdates/home) I found this

Enable Secure Static Resources for Lightning Components COMPLETE STEPS BY: 29.11.2020 TEST RUN SUPPORTED To improve security, this update serves all static resources from the Visualforce domain instead of the Lightning domain.

What is changing?

To improve security, this update serves all static resources from the Visualforce domain instead of the Lightning domain. This change affects Aura and Lightning web components. We recommend that you test this update in a sandbox org to verify correct behavior before enabling it in your production org.

What improvements can I see?

This update improves security by serving static resource from the Visualforce domain instead of the lightning domain. This change prevents a script included in a static resource from accessing the document in the lightning domain due to the same-origin security policy.

How is my org impacted?

This update serves static resources from the Visualforce domain instead of the lightning domain. A script included in a static resources can’t access the document in the lightning domain due to the same-origin security policy.

The crucial part here is "can't" access the document. My first reflex is to assume the word document means DOM (Document Object Model). Salesforce has done a lot to make it hard to access the DOM in the past because of security concerns. Central point is their locker service. To some degree I understand that, but in most parts an accessible DOM is the only ticket to use JS frameworks and existing powerful HTML/JS components, like charts, UI elements and 3D visualization tools.

We have several Aura Components using API Version 36.0 to avoid locker service. Also we use a lot of jQuery and other JS-Libraries to access the DOM. These are for instance

Does this "security update" mean, that all our Aura Components will break on 2020-11-29?

If this would be the case, I also can not see any workaround to prevent it.

Does it mean, that we are forced back to Vanilla JavaScript an the few libraries, which are allowed by Salesforce?

Improve this question
6
  • The Update "Enable Secure Static Resources for Lightning Components" causes a CORS issue for static resources loaded from an aura component. See the known issue trailblazer.salesforce.com/issues_view?id=a1p4V000001JipTQAS
    – Swetha
    Oct 20, 2020 at 11:24
  • For those who are using Aura or LWC, but have no idea if this is going to affect them, the relevant part of the Release Notes is here: releasenotes.docs.salesforce.com/en-us/winter21/release-notes/… It has some pointers to guides on the use of resources. A scan of your code for resource or $resource will give a quick indication of whether this update afects you.
    – Sander de Jong
    Oct 21, 2020 at 11:05
  • Does this mean we can't use static resource scripts at all in either Aura or LWC components? In that case, why is the name of this "feature" Secure Static Resources instead of Prohibition of Static Resources? Does this apply even if loadScript is used? Is Salesforce really saying I cannot provide any external scripts via static resources?
    – kamezaburo
    Oct 23, 2020 at 4:59
  • We are told that "This update serves static resources from the Visualforce domain instead of the lightning domain. A script included in a static resources can’t access the document in the lightning domain due to the same-origin security policy." However, as I read one of the examples created, it seems that the script won't be able to be loaded at all. I wonder which it is.
    – kamezaburo
    Oct 23, 2020 at 20:12
  • This update is postponed to Summer ’21. It was scheduled for auto-activation (enforcement) in Spring ’21. Does this release notes answer any of your questions? releasenotes.docs.salesforce.com/en-us/winter21/release-notes/…
    – Anudeep Gopagoni
    Oct 27, 2020 at 16:53

1 Answer 1

Reset to default
5

Enable Secure Static Resources for Lightning Components has been postponed indefinitely, as per the Summer 21 release notes:

This release update has been postponed indefinitely while we change the implementation to reduce customer impact. The release update won’t be enforced in its present form. Don’t enable it.

Unless Salesforce changes their mind in the next few weeks leading up to release (which I very much doubt), you should be okay for now, and we'll probably get more info later about what the impact will ultimately be as they work on the new implementation.

UPDATE: Still postponed indefinitely as of Spring 22

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.