Salesforce Lightning Locker Tools

-

Lightning Locker tools help you develop more secure code that is compatible and runs efficiently with Lightning Locker.

Lightning Locker API Viewer

Locker API Viewer shows Lightning Locker’s support of the standard DOM APIs in the Window, Document, and Element objects. The SecureWindow, SecureDocument, and SecureElement wrappers prevent the use of APIs that are labeled Not Supported.

Locker Console Overview

Use Locker Console to check your JavaScript code’s compatibility with Lightning Locker, and compare how it runs with Lightning Locker enabled and disabled.

MIME Types Permitted - MIME Types Permitted | Lightning Aura Components Developer Guide | Salesforce Developers

Lightning Locker analyzes the MIME types used in Blob objects. Locker permits some MIME types, sanitizes some MIME types, and blocks the rest.

Lightning Locker allows these MIME types.

application/octet-stream — Default value for binary files
application/json — JSON format
application/pdf — Portable Document Format (.pdf)
video/ — All video/* mime types
audio/ — All audio/* mime types
image/ — All image/* mime types
font/ — All font/* mime types
text/plain — Text (.txt)
text/markdown — Markdown (.md)
application/zip — Zip archive (.zip)
application/x-bzip — Bzip archive (.bz)
application/x-rar-compressed — RAR archive (.rar)
application/x-tar — Tape archive (.tar)

Locker sanitizes text/html, image/svg+xml, and text/xml MIME types. These types are permitted but Locker removes potentially malicious code.

Any other types are blocked with the error message Unsupported MIME type.

To send binary files that are not explicitly permitted, specify the MIME type as application/octet-stream.

Secure Wrappers - Secure Wrappers | Lightning Aura Components Developer Guide | Salesforce Developers 

For security, Lightning Locker restricts the use of global objects by hiding an object or by wrapping it in a secure version of the object. For example, the secure version of window is SecureWindow. Locker intercepts calls to window and uses SecureWindow instead. Some methods and properties have different behavior or aren’t available on the secure objects.

Lightning Locker also replaces instances of other objects, such as components and events, with secure wrapped versions. 

Here’s a list of the most common wrappers that you encounter.

  • SecureAura
  • SecureComponent
  • SecureComponentRef
  • SecureDocument
  • SecureElement
  • SecureObject
  • SecureWindow


Comments

Post a Comment

Popular posts from this blog

Introduction to Salesforce Agent Script: Build Predictable AI Agents

-
Image
Please visit here for more details - https://ayaninsights.com/guestblogs/introduction-to-agent-script/ In my latest blog, I introduce Salesforce Agent Script and explain how it helps teams build AI agents that are more predictable, controlled, and aligned with business processes. Large language models are flexible, but relying only on natural-language instructions can sometimes produce inconsistent results. Agent Script addresses this challenge by combining the conversational capabilities of an LLM with structured business logic. The blog explains how developers can use conditions, variables, actions, topics, and transitions to control how an Agentforce agent behaves. Agent Script supports familiar logic such as if/else conditions, value comparisons, sequential actions, and checks for missing data. I also cover its core structure, including system settings, configuration, global variables, languages, connections, and topic blocks. The start_agent topic acts as the entry point for each...
Read more

Anti-Patterns in Salesforce Agentforce: What to Avoid When Building AI Agents

-
Image
Salesforce Agentforce is powerful because it allows teams to build AI agents that can understand user intent, retrieve grounded information, execute actions, and support business workflows across Salesforce. But like any powerful platform, the quality of the implementation matters. A good Agentforce implementation does not start with “How many things can the agent do?" It starts with “What problem should the agent solve reliably?” That is where anti-patterns come in. Anti-patterns are common implementation habits that look useful at first but eventually create confusion, poor user experience, inconsistent answers, or hard-to-maintain agents. Below are some of the most common Agentforce anti-patterns and how to avoid them. 1. Trying to Build One Agent That Does Everything One of the biggest mistakes is designing a single agent to handle every business process, every department, and every possible customer question. At first, this feels efficient. One agent, many use cases. Bu...
Read more

MCP vs. Traditional APIs: Choosing the Right Integration Approach

-
Image
Enterprise integration has traditionally been built around APIs. Applications send structured requests, services process them, and predictable responses are returned. This model has supported everything from payment processing and customer portals to mobile applications and large-scale system integrations. The rise of AI agents introduces a different integration challenge. An AI agent does not always follow a fixed sequence designed in advance. It may need to determine which system to use, discover the operations available to it, gather relevant context, and select the appropriate action based on a user’s request. This is where the Model Context Protocol, or MCP, becomes relevant. MCP and traditional APIs are related, but they solve different problems. APIs expose system capabilities. MCP provides a standardized way for AI applications to discover and use those capabilities as tools and contextual resources. Understanding this distinction is important when designing enterprise AI solut...
Read more