What is Lightning Web Security (LWS)?

Question

Salesforce has just announced a new Beta feature in the Winter ’22 release notes: Lightning Web Security. What is this exactly?

Answer 1

Lightning Web Security (LWS) is a new client-side security architecture for Lightning Web Components (LWC) that replaces Lightning Locker. LWS is defined by fewer restrictions while preserving the same strong security capabilities of Lightning Locker, such as blocking or modifying behavior of APIs that aren’t secure.

How is it implemented?

LWS implementation is modeled after the latest TC39 standards that will evolve with browser platforms as time goes by. Components are isolated in their own detached namespace JavaScript sandbox. This lets us expose document, window, and element global objects directly, without opening the door to security threats. LWS alters code running in the JavaScript sandbox to prevent unsafe behavior.

What can I do with LWS that I couldn’t with Lightning Locker?

With LWS you can:

• Import and use LWCs from different namespaces via composition or extension.
• Interact with global objects.
• Use 3rd party libraries that manipulate global objects.

LWS also provides improved performance compared to Lightning Locker because it doesn’t use secure wrappers which can reduce performance.

How can I activate it?

You can activate LWS for your custom LWCs in a Spring ’22. This will affect all your custom components, including those in managed packages. Go to Setup → Session Settings and enable “Use Lightning Web Security for Lightning web components”.

Note that LWS is GA in Spring '22 only for LWC. Activating it in a mixed mode org (Aura + LWC) is not yet supported and issues may arise.

How can I report issues?

To report issues, give feedback, and ask questions about LWS, go to this link.

Where can I learn more?

Take a look at these resources:

• LWC Developer Guide
• LWS FAQ
• LWS announcement in the Winter ’22 release notes
• Lightning Web Security Basics Trailhead badge