Lightning Web Security (LWS) is a new client-side security architecture for Lightning Web Components (LWC) that replaces Lightning Locker. LWS is defined by fewer restrictions while preserving the same strong security capabilities of Lightning Locker, such as blocking or modifying behavior of APIs that aren’t secure.
How is it implemented?
LWS implementation is modeled after the latest TC39 standards that will evolve with browser platforms as time goes by. Components are isolated in their own detached namespace JavaScript sandbox. This lets us expose document, window, and element global objects directly, without opening the door to security threats. LWS alters code running in the JavaScript sandbox to prevent unsafe behavior.
What can I do with LWS that I couldn’t with Lightning Locker?
With LWS you can:
- Import and use LWCs from different namespaces via composition or extension.
- Interact with global objects.
- Use 3rd party libraries that manipulate global objects.
LWS also provides improved performance compared to Lightning Locker because it doesn’t use secure wrappers which can reduce performance.
How can I activate it?
You can activate the LWS Beta for your custom LWCs in a WinterSpring ’22 pre-release org. This will affect all your custom components, including those in managed packages. Go to Setup → Session Settings and enable “Use Lightning Web Security (beta) for Lightning web components”.
If you don’t have a pre-release org, you can sign-up for one here before the release date.
Is this available for Aura?
The Note that LWS Beta is GA in Spring '22 only available for custom LWCsLWC. Activating it in a mixed mode org (Aura + LWC) is not yet supported and issues may arise.
How can I report issues?
To report issues, give feedback, and ask questions about LWS, go to this link.
Where can I learn more?
Take a look at these resources:
- LWC Developer Guide
- LWS FAQ
- LWS announcement in the Winter ’22 release notes
- Lightning Web Security Basics Trailhead badge
