Salesforce Lightning Service Worker

A specialized HTTP client and service worker for Salesforce Lightning applications that provides automatic CSRF (Cross-Site Request Forgery) protection for API requests. This package ensures secure communication with Salesforce APIs by automatically managing CSRF tokens.

Installation

npm install @conduit-client/salesforce-lightning-service-worker

Usage

This package provides the ConduitClient which offers two mechanisms for CSRF protection:

1. Default Behavior

By default, the ConduitClient API wrap its underlying calls to native fetch with automatic CSRF protection in the form of including the CSRF header, when required as well as token refreshes with a retry:

import { ConduitClient } from '@conduit-client/salesforce-lightning-service-worker';

// Create a client instance
const client = ConduitClient.create();

// Make API calls - CSRF protection is automatic for protected endpoints
const response = await client.fetch('/services/data/v65.0/sobjects/Account', {
  method: 'POST',
  body: JSON.stringify({ Name: 'Test Account' }),
});

CSRF Protection Features

This package provides automatic CSRF protection with the following features:

Automatic Token Management

• Token Caching: CSRF tokens are cached using the Cache API for performance
• Token Refresh: Automatically refreshes tokens when they become invalid
• Retry Logic: Retries requests once with fresh tokens on authentication failures

Protected Endpoints

• Method Protection: Automatically protects data-mutating methods (POST, PUT, PATCH, DELETE)
• URL Protection: Currently protects all Salesforce API endpoints under /services
• Intelligent Detection: Only applies CSRF protection where needed

Building for Production

npm run build

This creates production-ready files in the dist/ directory.

Browser Support

Requires browsers with service worker support. The registration function includes feature detection and will gracefully handle unsupported browsers.

This software is provided as-is with no support provided.