# Aura Endpoints Disallowed by Lightning Web Security

Lightning Web Security (LWS) disallows access to URL endpoints containing `/aura` and `/webruntime` because they’re part of the Lightning Component framework.

These JavaScript APIs are affected.

- `fetch`
- `Navigator.sendBeacon`
- `XMLHttpRequest.open`
- `HTMLObjectElement.prototype.data` setter

**See Also**

- [LWS Distortion Viewer](https://developer.salesforce.com/docs/component-library/tools/lws-distortion-viewer#Window_fetch-value)