We would like to use/build community using communities lightning. The problem we encounter is that there is no possibility to add any javascript from external resource/CDN.

The issue is that this is the only way you use 99% of marketing tools. The problem we encounter is related to Blueconic - automated profiling tool.

I know there is an option to store JS in static resources and load this way - but still this cannot be done in the head section. Am I correct? For me actually means show stopper and one client for SF less.

I have seen Load CSS and JS from CDN in Lightning component. Mentioned topic is not solved and what is important in my situation external resources must be loaded in the HEAD section of the page - NOT in component - so it's different place in the platform.

  • 1
    You can add a VF page component in Lightning and include resource/CDN functionality within that to integrate with the systems you wish. Basically VF pages act as iframes within lightning components
    – RedDevil
    Commented May 31, 2017 at 12:30
  • 2
    Possible duplicate of Load CSS and JS from CDN in Lightning component
    – glls
    Commented May 31, 2017 at 12:48
  • It is duplicate with the one above - according to one of the comments it should be possible - but no confirmation - that is why I created new topic. Commented May 31, 2017 at 12:50
  • Also there were updates to lightning and communities since then Commented May 31, 2017 at 12:50
  • 1
    Yeah, I read the comment as well, but there is no supporting documentation. I even did a quick research. and the documentation still states that this is not an available feature at the moment
    – glls
    Commented May 31, 2017 at 12:55

1 Answer 1


As of Summer '17 with locker service and with "Enable Stricter CSP for Lightning Components" Enabled it will no longer be supported. the documentation lists supported tags and attributes as well as an IMPORTANT note.

Important: With the "Enable Stricter CSP for Lightning Components in Communities" critical update, you have control over whether to enforce stricter CSP. When stricter CSP is activated, some of your existing head markup may not work correctly. Test your markup in your sandbox or DE orgs first before activating in live orgs in a future release.

For security purposes, we restrict the tags, attributes, and values allowed in the head markup of your pages


Allowed Attributes:

href, target


Allowed Attributes:

as, charset, crossorigin, disabled, href, hreflang, id, import, integrity, media, rel, relList, rev, sheet, sizes, target, title, type

**For rel, allowed values are alternate:

apple-touch-icon, apple-touch-icon- precomposed, apple-touch-startup-image, author, bookmark, external, help, icon, license, manifest, mask-icon, next, nofollow, noopener, noreferrer, pingback, prefetch, preload, prev, search, shortcut icon, stylesheet, and tag.


Allowed Attributes:

charset, content, http-equiv,2 name, scheme

**For http-equiv, allowed values are cleartype, content-type, content-language, and default-style.


None allowed

If you do add scripts you will get the following message:

enter image description here

You will have to monitor and check for critical updates and decide which ones to enable/disable.

  • Actually it looks like you can disable the stricter CSP.
    – Adrian Larson
    Commented May 31, 2017 at 13:18
  • =P still updating the answer, but indeed, I will include the Note!
    – glls
    Commented May 31, 2017 at 13:19
  • How shall I read this? Does it mean that we will be able to use external CDN? It seems like this is an issue for me with Blueconic. I cannot move their script locally - they do not allow, I cannot use external CDN because it is not allowed by SF.... Commented Jun 6, 2017 at 8:21
  • Not recommended, however, you can if Stricter Content Security Policy for Lightning Components in Communities is disabled
    – glls
    Commented Jun 6, 2017 at 19:20
  • I can confirm what has been said before. Since Summer '17 it is (again) possible to use js script served from external CDN - also in the header. This will be valid till Winter '19 (communities). In my opinion Salesforce this is not only a time for us to fix our scripts but also for Salesforce to find a safe way to keep this functionality. Thanks for all responses. Commented Jun 7, 2017 at 9:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .