I know little bit knowlege of lightning components. I am new to Lightning locker service. What is the difference between lightning with locker service and without locker service? how to know it is using with locker service or not in lightning components. Could you please anybody reply on this post.
2 Answers
Locker service enforces some of the java-script security best practices and also helps component isolation by ensuring they are not able to see and edit each others attributes both in same and different namespace.
Locker uses browser CSP (Content Security Policy) to prevent a web page against cross-site scripting (XSS), clickjacking and other code injection attacks resulting from execution of malicious content in the trusted web page context.
From documentation below
Locker Service is a powerful security architecture for Lightning components. Locker Service enhances security by isolating Lightning components in their own namespace. Locker Service also promotes best practices that improve the supportability of your code by only allowing access to supported APIs and eliminating access to non-published framework internals.
how to know it is using with locker service or not in lightning components
Any new component created now in your salesforce org will be with version 43 and any lightning component create with Api version 40 and higher will have locker service enabled.
In addition, - Locker enforces JavaScript's Strict Mode to improve on security. - It operates as on a whitelist model to remove insecure browser APIs, and replaces unsafe one with safe versions. - It filters raw HTML even if strict CSP isn't enabled. - It runs your code in a sandbox that help prevent conflict with other code.
Locker Service is meant to improve security but also stability by reducing the likelihood of conflict with other people's code.
