Loading

Scripts and Styles with Absolute URLs Don’t Load in Salesforce ltng:require After Summer ’26

Publiceringsdatum: Jul 29, 2026
Beskrivning

In Summer ’26, we made an update to the markup://ltng:require Aura component that fixed a security vulnerability. This fix restricted scripts that reference URLs to only support URLs that match the page origin. All external absolute URLs are rejected.

If your org uses absolute URLs with ltng:require, the Summer ‘26 fix can cause the component to not work properly.

Lösning

One workaround for this script restriction on external absolute URLs being rejected is to update your scripts and styles to use relative URLs (/resource/scriptName) instead where possible.

In some orgs, if the AuraSecStaticResCRUCPerm and AuraSecStaticResCRUCPref settings are enabled, the $Resource resolves to the VF domain, which may differ from the page origin. Contact Salesforce Customer Support to disable these settings if you’re encountering this issue. 

We’re working on a fix that will allow external absolute URLs if they’re in the Lightning or VF domain, or if they’re in your list of Trusted URLs in Setup.

In anticipation of the upcoming fix, we recommend that you add any external absolute URL you want to keep using with this component to the Trusted URLs list.

 

Ytterligare resurser

Lightning Aura Components Developer Guide: Using External CSS

Lightning Component Reference: Require | Legacy Components

Knowledge-artikelnummer

005390235

 
Laddar
Salesforce Help | Article