I'm adding Google's reCAPTCHA element to a Lightning component. Following Google's documentation, I added this JS snippet to the community in my scratch org:

<script src="https://www.google.com/recaptcha/api.js" async defer>

After saving that change, the CSP warning indicated it was being blocked and that I should whitelist third-party API's. I added https://www.google.com to the Trust Sites list in my scratch org, however, the CSP warning continue to pop-up indicating it was being blocked. How can I get my scratch org's CSP to correctly whitelist this URL so I can use reCAPTCHA?

  • in what context? LEX, lighting communities? – glls May 12 '19 at 23:17
  • and when you say not working, is it right after deploying? or even after adding it and activating it? – glls May 12 '19 at 23:21
  • I've added that script snippet to my community <head>. Even after whitelisting google.com I'm still getting the CSP warning saying the script is being blocked. – Matt Smith May 13 '19 at 2:06
  • did you push the cspTrustedsites metadata after creating the scatch org? – glls May 13 '19 at 2:25
  • and is it Active ? – glls May 13 '19 at 2:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.