5

I'm a new dev so feel free to scrutinize everything I post because I need to learn.

So I have a component and am utilizing a helper to send some data to one of our company's external sites using jQuery's POST method.

 $j = jQuery.noConflict();
           var prospieId = response.getReturnValue().Id;
           var fname = response.getReturnValue().First_Name__c;
           var lname = response.getReturnValue().Last_Name__c;
           var hphone = response.getReturnValue().Home_Phone__c;
           var wphone = response.getReturnValue().Work_Phone__c;
           var mphone = response.getReturnValue().Mobile_SMS_Phone__c;
           var email = response.getReturnValue().Personal_Email__c;
           var state = response.getReturnValue().State__c;
           var zip = response.getReturnValue().Postal_Code__c;

           $j.ajax({
               type:"POST",
               url: "https://companyname.website.com/post/e892b49b8412a5389b/",
               data: "firstname="+fname+"&lastname="+lname+"&phone="+hphone+"&phone2="+wphone+"&phone3="+mphone+"&email="+email+"&state="+state+"&zip="+zip+"&_ZIPLOOKUP="+zip+"&tp_id="+prospieId
           });

The error I receive when I try to view my console is this:

Refused to connect to 'https://company.website.com/post/e892b49b8412a5389b/' because it violates the following Content Security Policy directive: "connect=src 'self'".

Console Error Screenshot

I did try to add this URL in the Remote Site Settings in the Security Controls section of the setup tree in Salesforce. I have a jQuery library saved as a static resource per the Lightning Dev Requirements and have called it in my parent component. Is there some other setting within Salesforce's security controls that I am missing?

Improve this question
1

1 Answer 1

Reset to default
3

HTTP callouts are blocked by CSP (Contend Security Policy) by salesforce on purpose. The reason behind this are security concerns. You can try to make the callout in an serverside apex controller.

Improve this answer
2
  • 1
    Yea, we also can't manage offline for you without you going through a controller action. RichardT is correct.
    – Kris Gray
    Commented Oct 29, 2015 at 23:39
  • You can try adding it as a Trusted Site. Go to Setup -> Security -> CSP Trusted Site, and here add your website as a trusted site. This worked for me like a charm.
    – julianm
    Commented Nov 12, 2019 at 19:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .