Lightning Web Security

Lightning internet Security (LWS) is the next generation client-side security design for Lightning internet parts, and it’ll become GA for LWC-only orgs in Spring ’22. LWS provides a similar security measure as Lightning Locker, however it's an additional versatile design that produces its potential to implement several use cases that weren't potential with Lightning Locker. During this diary post, we’ll discuss however this new design is enforced, however LWS enablement works, and that new use cases it supports.

How does Lightning Web Security work?

Lightning Web Security is to stop Lightning parts from associating with or accessing knowledge of parts from alternative namespaces. A Salesforce page will embody parts created by various firms. Components created by a company’s developer team synchronize with parts created by Salesforce. If you produce apps and deploy them on AppExchange, your components be with components that Salesforce created and with the components of the client Who installs your app.

Without precautionary measures in place, a component can get the ‘window’ global objects and procure private resources or data from other components on the page. One preventative live is to isolate parts by namespace so a malicious part is unable to access the resources of parts outside its namespace.

Lightning Web Security is that the virtualization engine running within the host atmosphere, making and dominant the virtual environments.

The namespace JavaScript sandboxes are virtual environments. Lightning Web Security gives every virtual environment limited access to specific resources from the host environment. These resources include network access, global objects, local storage, cookie access and so on.

 

Where to Enable Lightning Web Security

This change applies only to Lightning web components in Lightning Experience. Aura components aren't supported.

Components Supported by Lightning Web Security. Currently Lightning Web Security supports only Lightning Web Components which are either installed through packages or created in org.

You can make sure by searching LWC in setup before enabling Lightning Web Security.

Even if your org does not have a single lightning Web component and has Aura components then LWS does not affect your org.

 

When to Enable Lightning Web Security

Components Present in Org	Enable LWS in Production Org	Testing to be performed
No Custom Components in Org	Yes	No Testing required as there are no components.
Custom LWC Components only	Yes, after sandbox test	Testing in Sandbox after enabling LWS in Sandbox
Both Custom Aura and Custom Lightning Components Present in org	No	Can Test by enabling LWS in Sandbox first. Then you can choose between lightning locker or LWS
Only custom Aura components	No	Do not enable LWS.

 

Why to Enable Lightning Web Security

The Lightning web component area unit is already running with Lightning Locker. We have a tendency to expect elements that run with Lightning Locker to conjointly run with LWS without code changes. LWS and Lightning Locker give several equivalent security protections. We’re beginning with orgs that contain solely Lightning net elements to reduce disruption

 

Enable Lightning Web Security in an Org

If the org in which you want to enable lightning Web Security consists of only Custom Lightning Components or not even single Custom Lightning Component then you are free to use lightning Web Security benefits.

To configure Lightning Web Security in your org:

1. From Setup, in the Quick Find box, enter Session, and then select Session Settings.
2. On the Session Settings page, select Use Lightning Web Security for Lightning web components and save.
3. Clear your browser cache after enabling or disabling Lightning Web Security to ensure the correct files are loaded in the browser.

New developer tool supported in LWS

 

Lightning Web Security Console
This is a replacement console (same concept as Locker Console) to assist you discover problems with LWS. Activate or Deactivate LWS after adding your code in console.

 

LWS Distortion Viewer
This is a tool within which all distortions applied by LWS area unit documented (same conception as Locker API Viewer). notice evidence of why Salesforce is applying a concrete distortion, alongside suggestions of other secure ways to implement your code.

LWS ESLint Plugin
ESLint plugin is a new plugin, it helps you to seamlessly determine or identify if you are using distorted APIs in your code with its set of rules. If a particular third-party library is consuming an API that’s distorted by running the linting rules over the library code you can see that with the help of this plugin.

 

Lightning Web Security Vs Lightning Locker. Which is more Secure.

Lightning Web Security and Lightning Locker both block or modify behavior of API’s that are not secure.

We can say that Lightning Web security and Lightning Locker both offer equal level security. Whereas Lightning Web security gives additional security by increasing JavaScript functionality and code execution time faster.

Lightning Web security offers a very fine grain approach of blocking unsafe behaviors and preventing architecture.

Lightning Locker uses wrapper but Lightning Web Security does not make use of wrappers. It rather uses distortions to selectively modify APIs that enable non-secure behaviors.

To prevent use of custom elements CustomElemetRegistry APIs are blocked by Lightning Web Security.

Lightning Web Security is not affected by API Version setting of Locker.

The setting to use Lightning Web Security is not related with any API version. When you enable the LWS, until you disable it all Lightning web components in the org are affected.

Lightning Web Security uses Cross namespace component – As Lightning Web components can import the components from other namespaces and use them by extensions or composition. Components get isolated in their own namespace JavaScript sandbox; security architecture performs communication virtually behind the scenes.

 

Wrapping Up

As the Technology advances the security concern also increases and so salesforce comes up with new and better ways to increase the security of data and with upgraded functionality. Hence, we now have Lightning Web Security (LWS) which is the next generation client-side security. Blueflame Labs, salesforce implementation partners can help you with Lightning Web Security. Get in touch to discuss it with our Salesforce experts.