I am working on a lightning component in my Salesforce Community. Yesterday it worked fine and out of the blue, I started getting the following error in the community builder. I am including the Twitter Widget js file in a static resource. I am also receiving the second error in the browser while visiting the page. Has anyone had issues like this before or with including a Twitter share button in their lightning components?

The full error messages I am receiving is:

Custom Script Eval error [SecureDOMEvent: [object Event]{ key: {"namespace":"c"} }]


Refused to load the script 'data:application/javascript;base64,DOZENSOFRANDOMCHARS' because it violates the following Content Security Policy directive: "script-src * 'unsafe-inline' 'unsafe-eval'".
  • have you enabled any critical updates? Oct 30, 2018 at 18:56
  • @PranayJaiswal we have not. Oct 30, 2018 at 19:12

1 Answer 1


This is likely caused by a change that Salesforce made in Winter 19:

Stricter CSP Restrictions

Stricter CSP disallows unsafe-inline for script-src. This means that script tags can’t be used to load JavaScript, and event handlers can’t use inline JavaScript.

You can disable this. Follow these steps:

Stricter CSP is enabled by default. To disable it:

  1. From Setup, enter Session in the Quick Find box, and then select Session Settings.
  2. Deselect the checkbox for “Enable Stricter Content Security Policy”.
  3. Click Save.

More details here

  • Thanks for the response, upon looking at the page you linked I noticed: The Lightning Component framework already uses Content Security Policy (CSP) I did deselect the checkbox which removed the refused to load script, however, the twitter script is still throwing the first error on the community builder. Oct 31, 2018 at 12:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .