I am working on a lightning component in my Salesforce Community. Yesterday it worked fine and out of the blue, I started getting the following error in the community builder. I am including the Twitter Widget js file in a static resource. I am also receiving the second error in the browser while visiting the page. Has anyone had issues like this before or with including a Twitter share button in their lightning components?

The full error messages I am receiving is:

Custom Script Eval error [SecureDOMEvent: [object Event]{ key: {"namespace":"c"} }]


Refused to load the script 'data:application/javascript;base64,DOZENSOFRANDOMCHARS' because it violates the following Content Security Policy directive: "script-src * 'unsafe-inline' 'unsafe-eval'".
  • have you enabled any critical updates? – Pranay Jaiswal Oct 30 '18 at 18:56
  • @PranayJaiswal we have not. – Nick McGinnis Oct 30 '18 at 19:12

This is likely caused by a change that Salesforce made in Winter 19:

Stricter CSP Restrictions

Stricter CSP disallows unsafe-inline for script-src. This means that script tags can’t be used to load JavaScript, and event handlers can’t use inline JavaScript.

You can disable this. Follow these steps:

Stricter CSP is enabled by default. To disable it:

  1. From Setup, enter Session in the Quick Find box, and then select Session Settings.
  2. Deselect the checkbox for “Enable Stricter Content Security Policy”.
  3. Click Save.

More details here

  • Thanks for the response, upon looking at the page you linked I noticed: The Lightning Component framework already uses Content Security Policy (CSP) I did deselect the checkbox which removed the refused to load script, however, the twitter script is still throwing the first error on the community builder. – Nick McGinnis Oct 31 '18 at 12:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.