After activating the Critical Update, I checked a couple of my orgs using Managed Packages which provide resources used on buttons and scripts in the Standard Salesforce domain. It surprised me that they still do work. Although I'm very happy, I would like to understand the Critical Update.
This works fine with and without the Critical Update. Note that against "best practice" I'm not using $Resource or URLFOR() since in plain JS context they are simply not available. The relative URI above will be translated into an absolute URI in my case on the pod EU3
This is because I include the resource with a relative path from the Standard Salesforce Domain - not from inside the package itself.
My understanding of the Critical Update was, that it will break the code, since the resource should be only available via
But this is (luckily!) not happening. The resource is still (after) activating the Update available via both absolute URIs. So is my understanding of the Critical Update wrong? It says at it's Impact Detail section:
Prior to the Winter ’15 release, some static resources, such as images and CSS files, were loaded from the Salesforce Domain. This update changes that behavior so that all static resources are loaded from the Visualforce Domain. This change to the origin domain can cause absolute references to static resources to break.
It’s a best practice to reference static resources by using the $Resource global variable and the URLFOR() function instead of static strings. For example:
These references are safe to use regardless of your organization’s settings for this Critical Update.
We recommend that you test this update in a sandbox or Developer Edition organization to verify correct behavior of your pages before enabling it in your production organization.
Is there a reproducable example of something what is actually broken by the activation of this Critical Update?
Does anyone anticipate the reason behind this Critical Update? What Salesforce is going to achieve with it?