# Build Components to Work with Lightning Web Security

When you develop Lightning components that are compatible with Lightning Web Security (LWS), follow these coding guidelines.

- [Avoid Mutating Objects](/docs/platform/lightning-components-security/guide/lws-mutation-alternatives.md)
  - : When you mutate an object in a component that’s running in LWS, that change isn’t propagated outside the namespace sandbox. Consider mutation alternatives, such as creating a shallow clone.
- [Avoid Using Map Objects](/docs/platform/lightning-components-security/guide/lws-map.md)
  - : Use of the Map object with LWS enabled can run into issues when the object is serialized. Instead of using a Map instance, you can use a plain JavaScript object in most cases.
- [Avoid Custom Properties on Standard JavaScript Objects](/docs/platform/lightning-components-security/guide/lws-standard-objects.md)
  - : Adding custom properties directly to a standard built-in JavaScript object can cause issues when the object is serialized. If you must add custom data to a DOM element, use the `dataset` property of DOM elements instead.
- [Specify a MIME Type for Blob Objects](/docs/platform/lightning-components-security/guide/lws-mime.md)
  - : LWS requires you to set the MIME type when you create Blob objects. LWS permits some MIME types, sanitizes some MIME types, and blocks the rest.
- [Script Tags Transformed to Fetch Calls](/docs/platform/lightning-components-security/guide/lws-script-tags.md)
  - : LWS transforms `<script>` tags into fetch calls. LWS downloads the script to evaluate it in the sandbox.
- [Access to iframe Content in LWS](/docs/platform/lightning-components-security/guide/lws-iframes.md)
  - : When LWS is enabled, Lightning components can access content in `iframe` elements when the content is from the same origin.
- [URL Protocol Schemes Allowed](/docs/platform/lightning-components-security/guide/lws-url-schemes.md)
  - : LWS restricts the `HTMLObjectElement.data` attribute and the src attribute for `iframe` elements to values that use the `http://` and `https://` schemes. URL schemes such as `javascript://` aren’t allowed.
- [Aura Endpoints Disallowed by LWS](/docs/platform/lightning-components-security/guide/lws-aura-endpoints.md)
  - : LWS blocks access to URL endpoints containing `/aura` and `/webruntime` because they’re part of the Lightning Component framework.
- [Analytics Libraries Blocked by LWS](/docs/platform/lightning-components-security/guide/lws-analytics.md)
  - : LWS prevents the third-party analytics scripts from accessing code running in the browser outside the JavaScript sandboxes.
- [Salesforce Global Variables Blocked by LWS](/docs/platform/lightning-components-security/guide/lws-restricted-globals.md)
  - : For Lightning web components, LWS blocks access to some global JavaScript objects that are available to other Salesforce features, such as `$A`, `Aura`, `Sfdc`, and `sforce`.
- [Third-Party Library Considerations for LWS](/docs/platform/lightning-components-security/guide/lws-js.md)
  - : Third-party scripts can encounter issues when running with LWS enabled if they have certain behaviors, such as adding themselves to the global `window` object or explicitly setting `"use strict"`.
- [Local Storage Limitations](/docs/platform/lightning-components-security/guide/lws-local-storage.md)
  - : LWS creates synthetic storage for each sandbox. The synthetic storage prevents code in one sandbox from retrieving data that belongs to another namespace or that was set in the global scope outside LWS sandboxes, which impacts the usage of the `localStorage` and `sessionStorage` APIs.
- [Objects Passed Between Components Are Proxied](/docs/platform/lightning-components-security/guide/lws-proxies.md)
  - : To maintain namespace isolation and reduce incompatibility, LWS proxies objects that are passed between components. To avoid issues related to proxies, pass values as JSON strings and parse them later.
- [Understand How LWS Architecture Affects Component Performance](/docs/platform/lightning-components-security/guide/lws-performance.md)
  - : LWS uses proxy objects, which can have a performance cost. To optimize performance, reduce heavy DOM usage where possible. When creating large collections of objects, minimize the use of global objects and use plain JavaScript objects instead.