Lightning Components Developer Guide

What is the Lightning Component Framework?
Quick Start
Creating Components
Using Components
Communicating with Events
Creating Apps
App Overview
Designing App UI
Creating App Templates
Developing Secure Code
Content Security Policy Overview
Writing Secure Code with LockerService
Salesforce Lightning CLI
Styling Apps
Using JavaScript
JavaScript Cookbook
Using Apex
Lightning Data Service (Developer Preview)
Controlling Access
Using Object-Oriented Development
Caching with Storage Service
Using the AppCache
Distributing Applications and Components
Debugging
Reference
PDF

Newer Version Available

This content describes an older version of this product. View Latest

Writing Secure Code with LockerService

LockerService is a powerful security architecture for Lightning components. LockerService enhances security by isolating individual Lightning components in their own containers. LockerService also promotes best practices that improve the supportability of your code by only allowing access to supported APIs and eliminating access to non-published framework internals.

LockerService Requirements

LockerService enforces several security features in your code.
JavaScript ES5 Strict Mode Enforcement
JavaScript ES5 strict mode is implicitly enabled. You don't need to specify "use strict" in your code. Enforcement includes declaration of variables with the var keyword and other JavaScript coding best practices. The libraries that your components use must also work in strict mode.
DOM Access Containment
A component can only traverse the DOM and access elements created by that component. This behavior prevents the anti-pattern of reaching into DOM elements owned by other components.
Restrictions to Global References
LockerService applies restrictions to global references. You can access intrinsic objects, such as Array. LockerService provides secure versions of non-intrinsic objects, such as window. The secure object versions automatically and seamlessly control access to the object and its properties.
Use the Salesforce Lightning CLI tool to scan your code for Lightning-specific issues.
Access to Supported JavaScript API Framework Methods Only
You can access published, supported JavaScript API framework methods only. These methods are published in the reference doc app at https://yourDomain.lightning.force.com/auradocs/reference.app. Previously, unsupported methods were accessible, which exposed your code to the risk of breaking when unsupported methods were changed or removed.

The preceding security features are enforced when LockerService is active in your org. LockerService is a critical update for this release. LockerService will be automatically activated for all orgs in the Summer ’17 release. Before the Summer ’17 release, you can manually activate and deactivate the update as often as you need to evaluate the impact on your org.

In a future release, LockerService will be extended to cover additional security features.
Stricter Content Security Policy (CSP)
LockerService will tighten CSP to eliminate the possibility of cross-site scripting attacks by disallowing the unsafe-inline and unsafe-eval keywords for inline scripts (script-src). As a best practice, eliminate use of these keywords in your code, and update third-party libraries to modern versions that don’t depend on unsafe-inline or unsafe-eval.

IE11 doesn’t support CSP, so we recommend using other supported browsers for enhanced security.

Note

These CSP changes aren’t enforced by LockerService currently, but it’s worth planning ahead. The Salesforce Lightning CLI tool reports issues that are enforced by LockerService today, as well as issues that aren’t enforced today, but which are planned to be enforced in the future.

Don’t Use instanceof

When LockerService is enabled, the instanceof operator is unreliable due to the potential presence of multiple windows or frames. To determine a variable type, use typeof or a standard JavaScript method, such as Array.isArray(), instead.

Activate the Critical Update

LockerService is a critical update for this release. LockerService will be automatically activated for all orgs in the Summer ’17 release. Before the Summer ’17 release, you can manually activate and deactivate the update as often as you need to evaluate the impact on your org.

To activate this critical update:

  1. From Setup, enter Critical Updates in the Quick Find box, and then select Critical Updates.
  2. For “Enable Lightning LockerService Security”, click Activate.
  3. Refresh your browser page to proceed with LockerService enabled.

We recommend that you test LockerService in a sandbox or a Developer Edition org to verify correct behavior of your components before enabling it in your production org.

Components Installed from Managed Packages

To control whether LockerService is enforced for components installed from a managed package:

  1. From Setup, enter Lightning Components in the Quick Find box, and then select Lightning Components.
  2. Select the Enable LockerService for Managed Packages checkbox to enforce LockerService for components installed from a managed package.

    The checkbox is only visible when the critical update is activated.

    Note

If you deselect the Enable LockerService for Managed Packages checkbox, LockerService is not enforced for components installed from a managed package. Components that you create in your org still run with enforcement of LockerService restrictions.

Default Settings for New Orgs

Here’s a table summarizing when LockerService is enforced for new orgs.

Components created in your org are in the default namespace, c, or in your org’s namespace, if you created a namespace.

Component Source Developer Edition All Other Supported Editions
Created in your org Yes Yes
Managed package Yes No

You can change LockerService enforcement by toggling the critical update (for components created in your org) or the Enable LockerService for Managed Packages checkbox (for components from managed packages).