Please help on this urgent issue:

We have a public VF page which includes a Lighting Competent (via a Lightning App). We are using the ltng:outAppUnstyled or ltng:outApp tags. Since we started testing in Spring '19 sandbox we are getting an Insecure Content Blocked error on the browser (all browsers). I can then click and allow the content and the page loads as expected.

In Production Winter '19 its working fine.

Insecure Content Blocked

In the browser I see this error:

This page has an error. You might just need to refresh it. Error in $A.getCallback() [An unknown error occurred attempting to fetch definitions at: https://abc.cs109.force.com/auraCmpDef?aura.app=markup://c:Customer_Invoice&_ff=DESKTOP&_l=true&_l10n=en_US&_style=undefined&_def=markup://c:Customer_Question&_uid=LATEST-0] Failing descriptor: {ltng:outAppUnstyled}

And in the browser console I see the following error:

CustomerInvoice?id=7654a4e54556d74456a84bc32fa008b8:1 Mixed Content: The page at 'https://abc.cs109.force.com/CustomerInvoice?id=7654a4e54556d74456a84bc32fa008b8' was loaded over HTTPS, but requested an insecure script 'http://abc.cs109.force.com/auraCmpDef?aura.app=markup://c:Customer_Invoice&_ff=DESKTOP&_l=true&_l10n=en_US&_style=undefined&_def=markup://c:Customer_Question&_uid=7rW20NXLNeiBkxs0Ywl8VQ'. This request has been blocked; the content must be served over HTTPS.

  • 1
    Could you add https URL instead of http for loading resources? We had one issue with a internal page in spring'19, worked fine after changing to https – Raul Jan 29 '19 at 12:22
  • @Raul - all our urls are https. What you see is something internal to lightning – Dedo Jan 29 '19 at 14:58

This problem is probably caused by site settings. Update sites settings accordingly:

1. Go to Setup -> Develpe -> Sites
2. Click on "your community name"
3. Click "Edit"
4. Select checkboxes:
Require Secure Connections (HTTPS) 
Upgrade all requests to HTTPS
Enable Content Sniffing Protection
Enable Browser Cross Site Scripting Protection  
Referrer URL Protection 
4. Click Save
| improve this answer | |
  • the problem is that salesforce uses a script auraCmpDef to load components into the visual flow we are using inside the VF page. And they serve this script from an http link instead of https which makes the browser block it – Dedo Feb 1 '19 at 2:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.