Most examples of implementing a callout as part of a LWC involve calling an Apex method that handles the callout and returns the response to the JS controller. What are the reasons we callout from Apex, rather than handling the HTTP request client-side?

I'm thinking of a couple reasons but would like to check my understanding.

  1. Calling from client side would expose the headers in the network request from the Network browser inspection tab.
  2. If we pull our credentials from a metadata record in Salesforce setup, we then expose these directly in the client. (But isn't the file minified and obscured in a production environment?)

Am I understanding these correctly? And what are some other reasons?

1 Answer 1


We use Apex to reduce the possibility of security risks, as clients are relatively insecure. Using Apex can reduce the data exposed to the client, and avoid leaking secrets, such as private keys, passwords, or other kinds of API keys.

The CSP (Content Security Policy) of Lightning prohibits CORS (Cross-Origin Resource Sharing) in order to improve security, as well as mitigating the possibility of Cross Site Scripting (XSS) attacks. This limits the kinds of resources that can be loaded, which reduces possible attack vectors.

Further, the remote site needs to set Access-Control-Allow-Origin, otherwise the browser will reject the connection after performing a preflight callout. Therefore, CORS may not be applicable to various services, since many services do not allow this kind of scripting, also as a security feature.

  • Personally I think the last part of your answer is what you should start with. Why expose authentication or authorization values in the browser where they can be intercepted, especially if the user doesn't actually need to be aware of the external system in use? Browsers are really not very secure because the user can get at pretty much anything in it, and so can carefully crafted attacks. All the other points you made then relate the mechanisms put in place to make the browser more secure.
    – Phil W
    Jun 13, 2023 at 21:13
  • @PhilW You're right. Thanks for the feedback. I've shuffled things around a bit.
    – sfdcfox
    Jun 13, 2023 at 21:55
  • Thanks. The secrets, keys, and passwords can be exposed on the client browser network tab right? So that means the code being minified has no bearing on obscuring the sensitive data
    – Xaphy123
    Jun 14, 2023 at 15:38
  • @Xaphy123 Correct. Anything you don't want people to see should stay on the server.
    – sfdcfox
    Jun 14, 2023 at 15:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .