I have a custom component and when I try to use the following code:


<aura:component implements='forceCommunity:availableForAllPageTypes' access='global'>
      <aura:handler name="init" value="{!this}" action="{!c.executeComponentInitilization}"/>


    executeComponentInitilization : function(component, event, helper) {
        var req = new XMLHttpRequest();     
        req.onreadystatechange = function(event) {
            // XMLHttpRequest.HEADERS_RECEIVED
            if (req.readyState == 2) {
                req.responseType = "document";
                // XMLHttpRequest.DONE
            } else if (req.readyState == 4) {
                if (req.status === 200) {                    
                } else {
                    // Something went wrong.

        req.open('GET', 'https://anHTMLpage.com'); // used https://sitepreview.na40.force.com for tests

When LockerService is off, I am able to get a nice and sweet Document DOM object for the XMLHttpRequest.response when the responseType is document, but when LockerService is enabled, I only get an Object with a toString() method that returns: "SecureObject: [object HTMLDocument]{ key: {"namespace":"mynamepsace"} }"

Is this a bug? If so, will it be fixed in Summer 17? I tried to use the document.implementation.createHTMLDocument but it creates a document DOM without the right LockerService key/namespace.

  • This will have similar behavior in Summer '17. What to do with these dynamically created document objects is a non-trivial problem. If you need this behavior please bring it up through a more "official" SFDC channel like a customer case. Apr 10, 2017 at 18:11

1 Answer 1


If you haven't already, read Introducing The LockerService For Lightning Components and the more recent LockerService and Lightning Container Component: Securely Using Third-Party Libraries in Lightning Components. By design, access to the underlying DOM (and objects like XMLHttpRequest) is replaced by access through Secure JavaScript objects to accomplish the security goals of the platform. This is not something that will go away.

This Locker Service API Viewer suggests that the majority of functions are not blocked, and in theory most JavaScript code should continue to work assuming it is using mainstream JavaScript features. (Best not to assume though: test to find out.)

Do you have a specific problem with your code? If so please edit your question to provide more details in regards to your problem.

  • 1
    Hi @Keith C, yes I am aware of all those, but LockerService should simply parse the req.response to an actual secured DOM Document. Now it fails completely to parse the response and returns a very incomplete object. I tried to update my question to reflect that Mar 23, 2017 at 13:49
  • @Marc-AntoineVeilleux Have you tried invoking the normal DOM functions to see if they are supported? Also with "Enable Debug Mode" checked for Lightning Components in Setup you should be able to step into the platform code and see what is going on - commented source at foprcedotcom/aura/aura-impl/src/main/resources/aura/locker/. As old questions tend not to get answered, you might consider asking a more explicit question that includes anything new you have discovered.
    – Keith C
    Mar 23, 2017 at 14:15
  • From what I can see, when we pass a Dom Document to the SecureObject constructor, it simply ignore every property except the toString method. Mar 23, 2017 at 18:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .