2

I'm trying to add custom CSP as given in the link: https://developer.salesforce.com/docs/atlas.en-us.lightning.meta/lightning/container_csp.htm

index.html

<!DOCTYPE html>
<html lang="en">

<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no">
  <meta name="theme-color" content="#000000">
  <link rel="manifest" href="./manifest.json">
  <title>Title Page</title>
</head>

<body>
  <div id="root">Only Element</div>
</body>

</html>

manifest.json

{
  "landing-pages": [{
    "path": "index.html",
    "content-security-policy-type": "custom",
    "content-security-policy": "style-src 'self' css.example.com"
  }]
}

But I dont see the "content-security-policy" value is being added to the "Content-Security-Policy" on the response header.

Am I doing something wrong??

Thanks in advance.

Response Header:

Content-Security-Policy: default-src 'self'; script-src 'self' chrome-extension: 'unsafe-inline' 'unsafe-eval' https://sfdc.azureedge.net *.visualforce.com 'unsafe-eval' https://ssl.gstatic.com/accessibility/ 'nonce-6ae728d72555f715d4cbf040190e3a1382b5b0f3462247217bf8dcb58faaa7a5'; object-src 'self' https://my-domain-ed.documentforce.com; style-src 'self' chrome-extension: 'unsafe-inline' https://cdn.plyr.io https://s3.amazonaws.com https://my-dev-ed.lightning.force.com https://my--domain.visualforce.com https://my-domain-ed.documentforce.com https://my-dev-ed.my.salesforce.com https://my--domain.container.lightning.com https://www.youtube.com *.visualforce.com; img-src 'self' http: https: data: blob: https://cdn.plyr.io https://s3.amazonaws.com https://my-dev-ed.lightning.force.com https://my--domain.visualforce.com https://my-domain-ed.documentforce.com https://my-dev-ed.my.salesforce.com https://my--domain.container.lightning.com https://www.youtube.com *.visualforce.com; media-src 'self' https://cdn.plyr.io https://s3.amazonaws.com https://my-dev-ed.lightning.force.com https://my--domain.visualforce.com https://my-domain-ed.documentforce.com https://my-dev-ed.my.salesforce.com https://my--domain.container.lightning.com https://www.youtube.com *.visualforce.com https://my-domain-ed.documentforce.com; frame-ancestors https://my-dev-ed.lightning.force.com; frame-src https: mailto: https://cdn.plyr.io https://s3.amazonaws.com https://my-dev-ed.lightning.force.com https://my--domain.visualforce.com https://my-domain-ed.documentforce.com https://my-dev-ed.my.salesforce.com https://my--domain.container.lightning.com https://www.youtube.com *.visualforce.com; font-src 'self' https: data: https://cdn.plyr.io https://s3.amazonaws.com https://my-dev-ed.lightning.force.com https://my--domain.visualforce.com https://my-domain-ed.documentforce.com https://my-dev-ed.my.salesforce.com https://my--domain.container.lightning.com https://www.youtube.com *.visualforce.com; connect-src 'self' https://api.bluetail.salesforce.com https://staging.bluetail.salesforce.com https://preprod.bluetail.salesforce.com https://cdn.plyr.io https://s3.amazonaws.com https://my-dev-ed.lightning.force.com https://my--domain.visualforce.com https://my-domain-ed.documentforce.com https://my-dev-ed.my.salesforce.com https://my--domain.container.lightning.com https://www.youtube.com *.visualforce.com; report-uri /_/csp

I'm using this from a lightning component as below:

<lightning:container src="{!$Resource.Container  + '/index.html'}" onmessage="{!c.handleMessage}" onerror="{!c.handleError}" />
Improve this question
1
  • Can you include the response headers that your getting to the question ? Also where is the lightning:container embedded app or component ?
    – Sumuga
    Commented Apr 27, 2018 at 8:18

3 Answers 3

Reset to default
0

It seems this link: https://developer.salesforce.com/docs/atlas.en-us.lightning.meta/lightning/container_csp.htm is outdated ... script-src wont be obeyed.

Hence it wont work.

Improve this answer
0

Salesforce has removed CSP functionality for lightning:container as documented here. Sure wish they'd remove out dated documentation of this functionality so we didn't all waste our time trying to get it to work... classic Salesforce.

Previous versions of lightning:container allowed developers to specify the Content Security Policy (CSP) of the iframed content. We removed this functionality for security reasons. The CSP level of all pages is now set to high. This value provides the greatest security, because content can be loaded only from the Lightning domain.

Note, this seems to make lightning:container operate in an even MORE strict setting than components outside of a container and also ignores CSP whitelist in Salesforce Setup (wut?). Security at Salesforce is out of control and undermining Salesforce as a developer platform...

Improve this answer
-1

Did you try adding the URL in content security policy settings? Type CSP in setup. Click on CSP Trusted sites. Add new CSP Trusted Site just like we add a remote site setting. Use below link for further information.https://help.salesforce.com/articleView?id=csp_trusted_sites.htm&type=5

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .