---
schema_version: "1"
id: 38e1ad4903e1bfe4ea5fada871ad23d52d101603ec01e900943cd8bbd1ca1247
title: Aura Endpoints Disallowed by Lightning Web Security
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/lwc/lightning-components-security/guides/lws/lws-aura-endpoints.md
canonical_url: https://developer.salesforce.com/docs/platform/lightning-components-security/guide/lws-aura-endpoints.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 33aa8fcc108e6914f3c1f2c1c7f9836fc55d89dc45e47d03994eb5e8b6e0c7e0
products:
  - Security for Lightning Components
  - lwc
---
# Aura Endpoints Disallowed by Lightning Web Security

Lightning Web Security (LWS) disallows access to URL endpoints containing `/aura` and `/webruntime` because they’re part of the Lightning Component framework.

These JavaScript APIs are affected.

- `fetch`
- `Navigator.sendBeacon`
- `XMLHttpRequest.open`
- `HTMLObjectElement.prototype.data` setter

**See Also**

- [LWS Distortion Viewer](https://developer.salesforce.com/docs/component-library/tools/lws-distortion-viewer#Window_fetch-value)