4

We are trying to implement Stripe integration with Salesforce by using Lightning Components for payments.

Stripe use an API for securely obtain the users card information. This API is for the client, so we have to import it as a script. The problem is that Lightning doesn't allow script tags, so we downloaded the JavaScript file from Stripe and added to the org as a static resource, then we added it with the ltng:require tag, but Stripe does not allow to use their API from another domain than stripe.com, so it didn't worked.

Then we tried to add a script tag with the url inside an aura:unescapedHtml, and it didn't worked again because we got the error "aura_prod.js:16 Refused to connect to 'https://js.stripe.com/v2/' because it violates the following Content Security Policy directive: "connect-src 'self'", directive set in the head tag, and it cannot be modified.

We are using Stripe API V2 because V3 doesn't work in lightning components, and if it worked, it would have the same problem.

Is there a way to use an external script in a lightning component?

  • This is most definitely not an answer, but we're using an AppExchange package from a company called Blackthorn (Blackthorn Payments). It's not very expensive, and its stripe integration is top notch. I do not work for them, but I am a customer – Sebastian Kessel Nov 6 '18 at 20:19
0

I asked in the partner community and basically you are out of lock trying to use a external script in a lightning component,

from salesforce:

Previous version of Lightning Container components allowed you to specify the CSP level, but we removed this functionality a few releases ago. The CSP level is now always set to high.

https://developer.salesforce.com/docs/atlas.en-us.lightning.meta/lightning/container_limits.htm

We are working on providing CSP Trusted Site support for Lightning Container Components and hope to make it available in Summer '19 (safe harbor)

and:

Lightning Container Components do not currently allow you to call out to external endpoints. We plan to add support similar to what is available to Lightning components in our Summer '19 release. Note that this still will not allow you to bring in external JavaScript. Doing so would introduce a potential security vulnerability.

For now, the only way you can bring in externally hosted JS is to do it in a Visualforce page.

So, I guess your only option would be to work with a Canvas App which you can use inside a Lightning Component.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.