2

I have been going through Lightning LockerService docs here

https://developer.salesforce.com/blogs/developer-relations/2016/04/introducing-lockerservice-lightning-components.html

It has been mentioned that one of the main reasons for LLS is to prohibit a component from issuing undocumented API call.

I believe we can even call an external webservice via JS written inside a VF page.

So how the security is enforced on a VF against an undocumented call executed by JS within it ?

Improve this question

2 Answers 2

Reset to default
2

Visualforce is rendered inside an Iframe in a separate domain.Browser Iframe is itself a native compartment and hence it prevents from accessing the DOM of the other frame .

IFRAMEs are used to embed and isolate third-party content.

Most of web solutions are based on iframes - because they give security (cross-domain policy) and isolated rectangle on screen which can be fully managed by third party content and scripting.

So essentially iframes do not need any locker service .Locker service is there so that mutliple third party apps can coexist inside same frame along with salesforce code .

Improve this answer
1

This question is pretty loaded. I will try to address each piece:

  1. main reasons for LLS is to prohibit a component from issuing undocumented API call

Lightning locker service(LS) it a security layer for custom lightning components and not for VisualForce components. Lightning components can be used in a VF page using Lightning Out. Regardless of how a custom lightning component was loaded on a page, they will be protected by locker service(if they have an API version of > 39.0 and opt into locker)

So yes, LS will prevent such components from making undocumented api calls.

The full list of supported aura APIs can be found in the Javascript API section here http://documentation.auraframework.org/auradocs#reference?topic=api:Component

The full list of supported browser APIs can be found here http://documentation.auraframework.org/lockerApiTest/index.app?aura.mode=DEV

  1. external webservice via JS written inside a VF page.

The org administrator still controls what end points can be whitelisted. You can find in the setup section.

  • Remote Site Settings - For Apex call outs, XHRs from visual force pages

  • CSP Trusted Sites - For lightning components

    1. So how the security is enforced on a VF against an undocumented call executed by JS within it ?

Javascript in your VF page has to go via $A to access anything lightning component related. $A has a defined API shape and any undocumented API is not guaranteed to work. But LS will not protect you there. If a Javascript snippet inside your custom lightning component(>v39.0) attempts the same undocumented API, LS will block it.

Hope that clears up your doubts.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .