I need to load Iframe from a lightning component in the community site( Napili template). Once I load Iframe from a lightning component I'm getting following error.

because it violates the following Content Security Policy directive: "frame-src https: mailto:".

How can I load Iframe from a Lightning component?

  • 1
    please can you include the relevant sections of the lightning component in the question.
    – Dave Humm
    Jun 30, 2017 at 7:51

1 Answer 1


Yes you can, and there are several posts addressing this question on the forum:

Is it posible to add iframe directly in lightning components?

iframes in Lightning components

However, the error seems to be in relation to the CSP directive, you can manage the CSP settings under critical updates as mentioned here.

Stricter CSP is enabled by default for sandboxes and Developer Edition orgs that have previously enabled the “Enable Lightning LockerService Security” critical update. For all other sandboxes and Developer Edition orgs, stricter CSP is disabled by default.

To disable stricter CSP:

From Setup, enter Critical Updates in the Quick Find box, and then select Critical Updates.

To “Disable Stricter Content Security Policy for Lightning Components”, click Disable. Refresh your browser page to proceed with stricter CSP Disabled.

(changed enable for disable within the text)

Not the answer you're looking for? Browse other questions tagged .