Lightning Web Security
By the end of this lesson, you'll be able to:
- Explain what Lightning Web Security (LWS) is and what it enforces
- Understand namespace isolation between components
- Recognize why attempting to bypass LWS is a red flag, not a clever workaround
Prerequisites: "with sharing, inherited sharing, and User-Mode Operations"
What Is Lightning Web Security?
Lightning Web Security (LWS) is the JavaScript security architecture automatically enforced on every LWC component running on the platform. Legacy note: LWS is the modern successor to an older mechanism called Locker Service — a name that may still appear in older documentation or discussions, but LWS is the current, active system.
What LWS Enforces
- Namespace isolation — components from different namespaces (e.g. different managed packages, or custom vs. managed code) cannot directly reach into each other's DOM or JavaScript, even though they might render on the same page.
- Restricted global API access — certain browser APIs that could be used maliciously or unsafely are restricted or wrapped.
- Sandboxed third-party code — a third-party library loaded via
loadScript(Module 11) still runs under LWS's protections, not with unrestricted access to the page.
Why This Matters in Real Projects
A component genuinely cannot be used to attack another component or the hosting page, even if it tried — this protection is largely invisible to correctly-written code, which never needs to fight against it. If a technique seems to require working around LWS to function, that is a strong signal something about the approach is wrong, not that LWS itself is the obstacle to defeat.
Exercise
Explain, as a comment, what namespace isolation prevents a component from doing to another component on the same page.
Show hint
Think about DOM and JavaScript access across namespace boundaries.
Exercise
Challenge: explain, as a comment, what the correct response is if a technique appears to require bypassing Lightning Web Security to work.
Show hint
Think about what that signal usually indicates about the approach itself.
Lightning Web Security Quiz
My Notes
Log in to keep private notes on this lesson.
Questions about this lesson
No questions yet — be the first to ask.
Log in to ask a question about this lesson.
Summary
Lightning Web Security is the JavaScript security architecture the Lightning platform enforces on every component — isolating namespaces from each other and restricting risky browser APIs, largely invisibly to correctly-written code.