Lightning Web Security

LWS is required

The Salesforce LWC uses third-party custom elements, including <forcecal-main>, backed by the browser Custom Elements API and Shadow DOM. Salesforce supports this with Lightning Web Security, not legacy Lightning Locker. See Salesforce custom-element support.

This page retains its historical URL so existing links still work. Earlier documentation claiming that the full Web Component integration was Locker-compatible was incorrect.

Deployment requirements

Enable LWS through your organization's approved Salesforce administration process, then test the matched LWC/Apex/static-resource build. A manual DOM container (lwc:dom="manual") allows the component to insert the custom element; it does not bypass Locker restrictions or authorize data access.

The production LWC loads a static resource with lightning/platformResourceLoader. It attaches listeners and sets properties before rendering the calendar. Custom events bubble and are composed so the host can receive them across Shadow DOM boundaries.

Security remains layered

• Use Apex for Salesforce record access; the controller enforces user-mode CRUD/FLS and sharing.
• readOnly is an interaction setting, not a substitute for permissions.
• Treat event titles/descriptions as plain text; do not inject them into HTML.
• Validate your CSP and host styling behavior. The absence of eval() does not mean arbitrary style-src rules will permit all Interface styles.
• Core calculation is separate from browser helpers: optional Workers and network/ICS helpers depend on host capabilities.

If the custom element fails to register, check the org's LWS setting, resource version and browser errors. Do not weaken security policies or claim support for Locker on the basis of a Jest test.