DriversRecommendedOutdated drivers can make a good PC feel brokenScan driver issues before chasing fixes manually.Scan NowOctober DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsClean PCRecommendedOne scan can reveal what keeps slowing WindowsLook for cleanup and repair opportunities.Run Scan×
Skip to content
World desk4 min

Salesforce Lightning E2E Tests: Handle Dynamic DOM and MFA Safely

Salesforce Lightning’s DOM can change without notice. Learn when to use Jest or browser automation, why Shadow DOM affects selectors, and how to test authorized login while preserving MFA.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Salesforce Lightning’s rendered HTML and DOM are not a stable compatibility contract. Build component behavior tests with Jest, reserve browser automation for complete user workflows, and treat selectors that depend on component internals as maintenance-prone. For authentication, preserve MFA: Salesforce documents authenticator apps and security keys, but its built-in MFA does not use one-time passcodes delivered by email, SMS, or phone calls.

How should you divide Lightning component tests and end-to-end tests?

Use the test layer that matches the question. A component unit test checks a component’s behavior in isolation; an end-to-end test checks whether an authorized user can complete a workflow through the application. Salesforce recommends Jest for Lightning Web Component unit tests and UI tools such as Selenium WebDriver for end-to-end testing. It does not recommend making a full browser test for every component detail.

As an Amazon Associate I earn from qualifying purchases.

Test layer What it answers Typical tool
Component unit test Does an individual component behave as intended? Jest
End-to-end test Can a user complete a workflow across the application? Selenium WebDriver or another UI testing tool

Salesforce cautions that Lightning Experience HTML, CSS, and DOM structure can change at any time and are not guaranteed to be backward-compatible. A test coupled to those details may need changes after UI updates even when the user-facing workflow remains the same. Salesforce’s LWC end-to-end testing guidance recommends limiting UI automation to the end-to-end layer.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Why can’t a global selector find an element inside a Lightning component?

Lightning Web Components use Shadow DOM to encapsulate component markup. A traditional document-level DOM query does not automatically search through a component’s shadow boundary, so a selector that works for a light-DOM element may not find an element inside a component.

Salesforce describes querying a component’s shadowRoot from client-side test code as one way to reach that markup. That can be useful when a test specifically needs to inspect component internals, but it creates a dependency on implementation details Salesforce does not promise to keep stable. Prefer testing the user-visible workflow; use internal DOM access only when its maintenance cost is justified.

How do Locker and Lightning Web Security affect DOM access?

Salesforce’s containment model limits a component to traversing and accessing DOM it created. The way those boundaries are enforced differs between Lightning Locker, Lightning Web Security (LWS), and browser Shadow DOM, so a test or component that assumes unrestricted access to another component’s elements can fail by design.

Salesforce says LWS is generally available and enabled by default for newer orgs. Before enabling it in production in an existing org, or for packaged components, validate the change in a sandbox and test the components your org depends on. The guidance is in Salesforce’s DOM access containment and LWS enablement documentation.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Which MFA methods can a Salesforce login test use?

Salesforce documents built-in authenticators, authenticator apps, and physical security keys as MFA verification methods. The phrase “OTP MFA” needs a distinction: the Salesforce MFA functionality does not accept one-time passcodes delivered by email, SMS text message, or phone call. That restriction does not mean an authenticator app’s generated code is the same as an OTP delivered through those channels.

Verification method What Salesforce documents Important qualification
Built-in authenticator or authenticator app Supported verification methods for MFA Use the organization-approved enrollment and login flow.
Physical security key Keys compatible with WebAuthn/FIDO2 or U2F; Salesforce names YubiKey and Google Titan as examples Compatibility depends on the org and configuration; non-privileged users require admin enablement.
Email, SMS, or phone-call OTP Not allowed by Salesforce’s built-in MFA functionality Do not design a Salesforce MFA test around receiving these codes.

Salesforce’s MFA verification-method guidance describes the supported methods and exclusions. For security keys, Salesforce says compatible WebAuthn/FIDO2 or U2F keys can be used across Salesforce products, but orgs on domains other than salesforce.com and force.com do not currently support U2F keys. Confirm current compatibility for the specific org, browser, and domain before choosing a key; consult Salesforce’s security-key guidance.

How can you automate login without bypassing MFA?

Keep test authentication within the organization’s approved setup. Use authorized test accounts, the actual Salesforce domain for the org, and the verification method configured for those accounts. Account permissions, browser behavior, domain, and org configuration can all affect the login flow, so a login test should run in the intended test environment rather than assume every org presents the same screens.

  1. Prepare the test identity. Ask the Salesforce administrator to provide an authorized test user with only the permissions needed for the workflow and an approved MFA enrollment.
  2. Use the org’s real login path. Point the browser test at the organization’s Salesforce domain and follow the supported sign-in and verification prompts. Do not remove, intercept, or work around MFA to make the test pass.
  3. Exercise the user workflow. After authentication, test the task through the application interface. Keep selectors tied to user-facing behavior where possible, and isolate any necessary internal DOM access so it can be maintained separately.
  4. Keep credentials and verification under control. Store and handle test credentials according to organizational policy. Do not put reusable secrets or MFA codes in test source, logs, or reports.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What should end-to-end tests prove about permissions?

A successful browser interaction is not proof that an operation is authorized. The client is under attacker control, and Salesforce’s secure-coding guidance says access checks must be enforced server-side. UI automation should verify the expected user experience, but it cannot replace server-side authorization or CRUD and field-level security checks.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Test both permitted and denied outcomes at the appropriate application and server boundaries. A button hidden in the interface is not, by itself, an access-control mechanism. See Salesforce’s Lightning Security Secure Coding Guide for the server-side security principle.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Windows Errors? Fix Them Before They SpreadFree repair scan
Outdated Drivers Are Slowing You DownFree scan - exact matches

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.