Salesforce Locker Service

-

Salesforce Locker Service is a security architecture provided by Salesforce for Lightning components. It aims to improve the security of the Lightning Component Framework by enforcing stricter JavaScript security policies and DOM access restrictions. Locker Service enhances the security and stability of Lightning components

Enabling Locker Service Provides the following features

Namespace Isolation: Locker Service isolates Lightning components in their own namespace, preventing them from accessing or modifying components in other namespaces. This isolation helps prevent conflicts and ensures that components behave predictably.

Secure DOM Access: Locker Service provides a secure wrapper around the Document Object Model (DOM), preventing Lightning components from accessing or modifying elements outside of their own DOM hierarchy. This helps mitigate security vulnerabilities such as cross-site scripting (XSS) attacks.

Strict JavaScript Context: Locker Service enforces strict JavaScript rules within Lightning components, prohibiting the use of global variables and functions that could potentially introduce security vulnerabilities or conflicts with other components.

API Versioning: Locker Service is versioned, allowing Salesforce to introduce new security enhancements and bug fixes without breaking existing Lightning components. Developers can specify the version of Locker Service to use in their Lightning components.

Example

<!-- SampleComponent.cmp -->

<aura:component>

    <aura:handler name="init" value="{!this}" action="{!c.doInit}"/>

</aura:component>

// SampleComponentController.js
({
    doInit : function(component, event, helper) {
        console.log(window.location.href);
    }
})

Without Locker Service enabled, this Lightning component would output the current URL to the console when initialized. However, with Locker Service enabled, this code would throw an error because it's trying to access the window object directly, which is not allowed.

To make this component Locker Service-compatible, we can use the $A.get() method to access the window location:

<!-- SampleComponent.cmp -->
<aura:component>
    <aura:handler name="init" value="{!this}" action="{!c.doInit}"/>
</aura:component>

// SampleComponentController.js
({
    doInit : function(component, event, helper) {
        var location = $A.get('$Sandbox').location.href;
        console.log(location);
    }
})

Locker Service is renamed Lightning Locker to better reflect that it is for securing code running on the Lightning Platform.

Links

$A namespace

Lightning Locker

Security with Lightning Locker

Comments

Post a Comment

Popular posts from this blog

Introduction to Salesforce Agent Script: Build Predictable AI Agents

-
Image
Please visit here for more details - https://ayaninsights.com/guestblogs/introduction-to-agent-script/ In my latest blog, I introduce Salesforce Agent Script and explain how it helps teams build AI agents that are more predictable, controlled, and aligned with business processes. Large language models are flexible, but relying only on natural-language instructions can sometimes produce inconsistent results. Agent Script addresses this challenge by combining the conversational capabilities of an LLM with structured business logic. The blog explains how developers can use conditions, variables, actions, topics, and transitions to control how an Agentforce agent behaves. Agent Script supports familiar logic such as if/else conditions, value comparisons, sequential actions, and checks for missing data. I also cover its core structure, including system settings, configuration, global variables, languages, connections, and topic blocks. The start_agent topic acts as the entry point for each...
Read more

Anti-Patterns in Salesforce Agentforce: What to Avoid When Building AI Agents

-
Image
Salesforce Agentforce is powerful because it allows teams to build AI agents that can understand user intent, retrieve grounded information, execute actions, and support business workflows across Salesforce. But like any powerful platform, the quality of the implementation matters. A good Agentforce implementation does not start with “How many things can the agent do?" It starts with “What problem should the agent solve reliably?” That is where anti-patterns come in. Anti-patterns are common implementation habits that look useful at first but eventually create confusion, poor user experience, inconsistent answers, or hard-to-maintain agents. Below are some of the most common Agentforce anti-patterns and how to avoid them. 1. Trying to Build One Agent That Does Everything One of the biggest mistakes is designing a single agent to handle every business process, every department, and every possible customer question. At first, this feels efficient. One agent, many use cases. Bu...
Read more

MCP vs. Traditional APIs: Choosing the Right Integration Approach

-
Image
Enterprise integration has traditionally been built around APIs. Applications send structured requests, services process them, and predictable responses are returned. This model has supported everything from payment processing and customer portals to mobile applications and large-scale system integrations. The rise of AI agents introduces a different integration challenge. An AI agent does not always follow a fixed sequence designed in advance. It may need to determine which system to use, discover the operations available to it, gather relevant context, and select the appropriate action based on a user’s request. This is where the Model Context Protocol, or MCP, becomes relevant. MCP and traditional APIs are related, but they solve different problems. APIs expose system capabilities. MCP provides a standardized way for AI applications to discover and use those capabilities as tools and contextual resources. Understanding this distinction is important when designing enterprise AI solut...
Read more