I have a aura and I need to open a custom tab Aura that I already create and send some parameters without send in the URL, because of the possibility that someone change the URL and access data that is not allowed.

I tried this example but I don't want to create a event for that (myEvent variable):

    doInit: function(component, event, helper) {
        var myAttribute = component.get("v.myAttribute");
        var sendData = {
            param1: 'value1',
            param2: 'value2',
            myAttribute: myAttribute
        var myEvent = $A.get("e.c:myevent");
            "sendData": sendData

        var navService = component.find("navService");
        var pageReference = {
            type: 'standard__component',
            attributes: {
                componentName: 'c__MyLWCComponent'
            state: {
                c__receivedData: sendData

How can I achieve this solution and get this parameters in the other aura?

1 Answer 1


What you've just described is listed as a vulnerability known as A01:2021 – Broken Access Control. If the user can view data they should not, you have a security vulnerability. Historically, a common example was from PHP, where there were variables like $_SESSION, $_QUERY, and $_REQUEST. Some developers would use $_REQUEST instead of $_SESSION, and subsequently you could just add ?admin=1 to a URL to become a system administrator. Validation should be done server-side, including checking permissions, rather than relying on obscuring secrets. Passing values by URL should be safe enough for most use cases.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .