Lightning Container + CSP issue in Spring '21

Question

I have a React app loading into a lightning-container from a static resource in both sandbox and production environments. This app has been humming along happily for a year without security issues.

As of the Spring '21 rollout, we're having all of our outbound HTTP calls blocked in Production.

Refused to connect to [fully-qualified-url] because it violates the following Content Security Policy directive: "connect-src 'self' wss://[org-name].container.lightning.com:80"

In our QA sandbox, these same HTTP calls are permitted by the CSP Trusted Sites configured in Setup as expected.

Inspecting the page's HTML, I see the correct CSP in the meta tag. I've tried copying those same definitions into the HTML being rendered within the lightning-container iframe, but that did not make a difference.

Our CSP Trusted Sites in Setup are 1:1 between these two environments.

This problem did not manifest before the Spring '21 release.

1. What can I do to enable CSP for my lightning-container in our Production environment? Did I miss something new in the Spring '21 changes?
2. Why is this working in our testing sandbox? Both environments are on Spring '21.

I've gone through all of the https://developer.salesforce.com/ forum posts that even sound related, and none seem to offer an effective solution. Many are out of date, recommending manifest changes that have been deprecated.

Any help would be appreciated!

Answer 1

Did some analysis here, one possible cause of this is due to following

Some infrastructure limits the maximum size of HTTP headers. Your configuration may exceed the recommended size of 3 KB for the LEX and Communities context.

So how do we solve this, we should aim to reduce the CSP header size and keep it less than that 3 KB limit. The limit is documented here

1. Deselect unneeded directives for existing trusted sites (for example if you need only connect-src just select that and unselect rest that does not matter)

2. Delete all unused trusted sites for these contexts before adding new ones

If the above does not solve I suggest opening a support case with Salesforce so the infrastructure team can immediately look at it.