- DOM Access Containment
- A component can only traverse the DOM and access elements created by that component. This behavior prevents the anti-pattern of reaching into DOM elements owned by other components.
- Restrictions to Global References
- LockerService applies restrictions to global references. You can access intrinsic objects, such as Array. LockerService provides secure versions of non-intrinsic objects, such as window. The secure object versions automatically and seamlessly control access to the object and its properties.
- Use the Salesforce Lightning CLI tool to scan your code for Lightning-specific issues.
The preceding security features are enforced when LockerService is active in your org. LockerService is a critical update for this release. LockerService will be automatically activated for all orgs in the Spring ’17 release. Before the Spring ’17 release, you can manually activate and deactivate the update as often as you need to evaluate the impact on your org.
- Stricter Content Security Policy (CSP)
- LockerService will tighten CSP to eliminate the possibility of cross-site scripting attacks by disallowing the unsafe-inline and unsafe-eval keywords for inline scripts (script-src). As a best practice, eliminate use of these keywords in your code, and update third-party libraries to modern versions that don’t depend on unsafe-inline or unsafe-eval.
These CSP changes aren’t enforced by LockerService currently, but it’s worth planning ahead. The Salesforce Lightning CLI tool reports issues that are enforced by LockerService today, as well as issues that aren’t enforced today, but which are planned to be enforced in the future.
Don’t Use instanceof
Activate the Critical Update
LockerService is a critical update for this release. LockerService will be automatically activated for all orgs in the Spring ’17 release. Before the Spring ’17 release, you can manually activate and deactivate the update as often as you need to evaluate the impact on your org.
To activate this critical update:
- From Setup, enter Critical Updates in the Quick Find box, and then select Critical Updates.
- For “Enable Lightning LockerService Security”, click Activate.
- Refresh your browser page to proceed with LockerService enabled.
Components Installed from Managed Packages
If the critical update is not visible, there is an exception for this release for components installed from a managed package. These components continue to run without enforcement of LockerService restrictions.
If the critical update isn’t visible, components that you create in your org run with enforcement of LockerService restrictions. Components created in your org are in the default namespace, c, or in your org’s namespace, if you created a namespace.
This exception is just for this release. When LockerService is enabled for all orgs, it will be enforced for all Lightning components.
Here’s a table summarizing when LockerService is enforced.
|Component Source||Critical Update Visible and Not Activated||Critical Update Visible and Activated||Critical Update Not Visible|
|Created in your org||No||Yes||Yes|