Lightning Web Security (LWS) on the Salesforce platform doesn't block most browser APIs — it namespaces, sanitizes, or sandboxes them. This post covers five categories of security anti-patterns in Lightning Web Components: namespaced APIs (localStorage, sessionStorage, document.cookie), sanitized/sandboxed APIs (innerHTML, eval), genuinely blocked APIs (document.write, Workers, ServiceWorker), cross-namespace boundary issues (proxy membrane, object mutation, structured cloning), and misattributed restrictions that actually come from the LWC framework or CSP rather than LWS. For each anti-pattern, the post explains the root cause and provides the correct alternative approach.
Table of contents
Three security layers instead of oneFive key anti-patternsConclusionResourcesAbout the author506 Impressions