---
schema_version: "1"
id: 92fe3323624b2f93f9e0247dd56c5431f11094f42c11e161b00f111073c2e5d6
title: Access to iframe Content in Lightning Web Security
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/lwc/lightning-components-security/guides/lws/lws-iframes.md
canonical_url: https://developer.salesforce.com/docs/platform/lightning-components-security/guide/lws-iframes.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 3da5df1631b1e7716e0ee1218a3b4f21908f86d303a132ad6e340e6d1e9b943a
products:
  - Security for Lightning Components
  - lwc
---
# Access to iframe Content in Lightning Web Security

When Lightning Web Security (LWS) is enabled, Lightning components can access content in `iframe` elements when the content is from the same origin. [Lightning Locker](https://developer.salesforce.com/docs/platform/lightning-components-security/locker/locker-intro.md) prevents accessing `iframe` content even from the same origin.

Web browsers prevent access to content from a different origin.
Browsers follow the [same-origin policy](https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy) to block cross-origin content in `iframe` elements. Some properties such as `iframe.contentWindow.postMessage` are allowed. For more about cross-origin accessible window properties, see [CrossOriginProperties](https://developer.salesforce.com/docs/platform/lightning-components-security/guide/%3Chttps://html.spec.whatwg.org/multipage/browsers.html#crossoriginproperties-(-o-)>) in the HTML spec.

LWS maintains the `iframe` identity across the sandbox boundary, so that checking the identity of `postMessage` event origin works normally.

LWS restricts the `src` attribute for `iframe` elements to values that use the `http://` and `https://` schemes. URL schemes like `javascript://` aren’t allowed.

LWS doesn’t allow iframe elements in Blob objects.