LWCAdvancedfilessecuritycontent-document
Implement secure file preview LWC without exposing public URLs
Real World Scenario
Compliance requires document preview in LWC without generating shareable public links or exposing ContentDocument download URLs to browser network tab.
Expected Answer
• Use getContent download via Apex serving blob to LWC as base64 or streaming — no public URL
• Enforce CRUD and sharing in Apex before read
• Preview in sandboxed iframe with blob URL created client-side from Apex response
• Audit preview access in custom object log
• Watermark or redact sensitive pages server-side if required
• Expire blob URLs on component disconnect
• Do not use ContentDistribution for internal confidential docs
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Stay within limits by: Use getContent download via Apex serving blob to LWC as base64 or streaming — no public URL. Bulkify everything — never query or DML in loops. Preview in sandboxed iframe with blob URL created client-side from Apex response. File preview architecture must assume browser devtools — never rely on obscurity of URLs. Optimize for scale and operational observability.
Architect Perspective
File preview architecture must assume browser devtools — never rely on obscurity of URLs.