I have a React app loading into a lightning-container from a static resource in both sandbox and production environments. This app has been humming along happily for a year without security issues.
As of the Spring '21 rollout, we're having all of our outbound HTTP calls blocked in Production.
Refused to connect to [fully-qualified-url] because it violates the following Content Security Policy directive: "connect-src 'self' wss://[org-name].container.lightning.com:80"
In our QA sandbox, these same HTTP calls are permitted by the CSP Trusted Sites configured in Setup as expected.
Inspecting the page's HTML, I see the correct CSP in the meta tag. I've tried copying those same definitions into the HTML being rendered within the lightning-container iframe, but that did not make a difference.
Our CSP Trusted Sites in Setup are 1:1 between these two environments.
This problem did not manifest before the Spring '21 release.
- What can I do to enable CSP for my lightning-container in our Production environment? Did I miss something new in the Spring '21 changes?
- Why is this working in our testing sandbox? Both environments are on Spring '21.
I've gone through all of the https://developer.salesforce.com/ forum posts that even sound related, and none seem to offer an effective solution. Many are out of date, recommending manifest changes that have been deprecated.
Any help would be appreciated!