I have created a lightning component which host the code for lightning:Map. The component is loading fine in Salesforce but in Communities, I am having the following error:

Access to resources from an unapproved, external host violates your Content Security Policy (CSP). To get access to these resources, try whitelisting the host in CSP Trusted Sites in Salesforce Setup. More Details

Blocked URI: https://5e7f3496-9b88-3b86-7d4a-7fd47535be70.a.forceusercontent.com CSP directive: frame-src

I tried to whitelist the url but the thing is that each time the component is being reloaded, the hash in the url changes.

Has anyone got a workaround on how to load the lightning:Map component without this error message.

enter image description here

The component code is exactly as in the Salesforce Documentation. We have not changed anything and works fine in Salesforce environment but not on community. lightning:Map source code example


4 Answers 4


I fixed it by including a "Content Security Policy Trusted Site" with the domain displayed in the error message. In my case the domain is always the same one "https://maps.a.forceusercontent.com".

Go to Setup > CSP Trusted Sites. And click on "New Trusted Site".

Tis is how should be created:

enter image description here

Hope that helps!


In lighting communities, under settings (the cogwheel icon on the right when in builder mode) there is a Security tab, which is supposed to "detect" CSP Errors, when it does, there should be an option to white list the URL.

enter image description here

  • This does not work since the url keep changing each time we refresh the page.
    – Kevan
    May 7, 2019 at 17:30
  • what a pain in the butt, so, the domain keeps changing?
    – glls
    May 7, 2019 at 17:31
  • yes, the uuid in the url changes for each refresh. https://5e7f3496-9b88-3b86-7d4a-7fd47535be70.a.forceusercontent.com This part: 5e7f3496-9b88-3b86-7d4a-7fd47535be70
    – Kevan
    May 8, 2019 at 18:07

You have to add the URL to CSP Errors whitelist like this: https://*.forceusercontent.com

NOT like this: https://5e7f3496-9b88-3b86-7d4a-7fd47535be70.a.forceusercontent.com

  • already tried with the wildcard, it just doesn't work.
    – Kevan
    Jun 9, 2019 at 8:17

Not much you can do about this but hope SFDC fixes it. Kinda scary that an OOTB comp does this as I'd much rather just call the google api rather then rely on lightning:map but we can't due that due to CSP ....and the suggested solution is now failing due to CSP. https://success.salesforce.com/issues_view?id=a1p3A000001FSlqQAG

Now for what it's worth. it's currently working for me in cs66 but not cs78.. same code same community (customer service latest) same settings.. same browser (chrome latest on win desktop) etc etc.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .