Aura Endpoints Disallowed by Lightning Web Security

Lightning Web Security (LWS) disallows access to URL endpoints containing /aura and /webruntime because they’re part of the Lightning Component framework.

These JavaScript APIs are affected.

  • fetch
  • Navigator.sendBeacon
  • XMLHttpRequest.open
  • HTMLObjectElement.prototype.data setter

See Also

Get Started
Lightning Web Security (LWS)
How LWS Works
Determine if LWS Affects Your Org
When to Enable LWS
Enable LWS in an Org
Enable and Disable LWS in Scratch Orgs
Workflow to Test Your Components with LWS
Tools for LWS
Considerations Before Using LWS-Only Features
Experience Builder Sites and LWS
Build Components to Work With LWS
Avoid Mutating Objects
Avoid Using Map Objects
Avoid Custom Properties on Standard JavaScript Objects
Specify a MIME Type for Blob Objects
Use Blob Objects for Download Links
Script Tags Transformed to Fetch Calls
Access to iframe Content in LWS
URL Protocol Schemes Allowed
Aura Endpoints Disallowed by LWS
Analytics Libraries Blocked by LWS
Salesforce Global Variables Blocked by LWS
Third-Party Library Considerations for LWS
Local Storage Limitations
Objects Passed Between Components Are Proxied
Understand How LWS Architecture Affects Component Performance
Debug with LWS Enabled
LWS Sanitization
Troubleshoot Issues Related to LWS
LWS Limitations
Lightning Locker
Content Security Policy (CSP)
JavaScript Strict Mode Enforcement