---
schema_version: "1"
id: 114dd1562646a8563c47c6dad530290295369da8597f1c2df74aae94920c7c53
title: Validate Secure Window Public API (secure-window)
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/platform/aura-platform/guides/aura/cli/cli-rules-secure-window.md
canonical_url: https://developer.salesforce.com/docs/platform/aura-platform/guide/cli-rules-secure-window.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 5e82b927c488375dd633fa32a1956a83fc08db542f3b72d809cbaca4940e9836
products:
  - Lightning Aura Components Developer Guide
  - Platform Developer Content
---

# Validate Secure Window Public API (secure-window)

This rule validates that only supported functions and properties of the `window` global are accessed.

When Lightning Locker is enabled, the framework prevents the use of unsupported API objects or calls. That means your Aura components code is allowed to use:

- Features built into JavaScript (“intrinsic” features)
- Published, supported features built into the Aura Components programming model.
- Published, supported features built into Lightning Locker _SecureObject_ objects

Prior to Lightning Locker, when you accessed the `window` global, you could call any function and access any property available. When Lightning Locker is enabled, the `window` global is “wrapped” by a new SecureWindow object, which controls access to `window` and its functions and properties. SecureWindow restricts you to using only “safe” features of the `window` global.

**See Also**

- [Validate Aura API (aura-api)](https://developer.salesforce.com/docs/platform/aura-platform/guide/cli-rules-aura-api.md)
- [Validate Aura Component Public API (secure-component)](https://developer.salesforce.com/docs/platform/aura-platform/guide/cli-rules-secure-component.md)
- [Validate Secure Document Public API (secure-document)](https://developer.salesforce.com/docs/platform/aura-platform/guide/cli-rules-secure-document.md)