FAQ-001092 - Lightning Message Channel Security / Alternative Communication Methods

Several secure alternatives exist for component communication without using exposed LMS channels: 1. **Use Private LMS Channels**: Set the `isExposed` attribute to `false` so the channel remains private to the package while still enabling communication between components within the same namespace. 2. **Pubsub Module**: Use the `pubsub` module as a secure alternative for event-driven communication between managed packages or namespaces, avoiding exposure of sensitive data. 3. **REST API Calls with Session IDs**: For communication between Visualforce pages and Lightning components, use session IDs obtained from Visualforce pages to make REST API calls. This method is approved for securely passing data. 4. **Data Sanitization**: Ensure that any data exposed to Lightning components is sanitized to prevent vulnerabilities like cross-site scripting (XSS). **Important Security Practices:** - Avoid exposing publish/handle message methods in components referencing LMS channels - Never pass sensitive information through URLs or unvalidated endpoints - Components within the same package can reference private LMS channels without security risks Using an exposed LMS channel to create a "hook" for custom JavaScript is not a security-compliant pattern because exposed LMS channels cannot verify the sender's trustworthiness.