Because of the Content Security Policy set when using Lightning components there I haven't found a way to include a Live Agent deployment as part of a Community built using the Winter '16 Community Builder. The same issue prevents Google Analytics from working too.

Is there a way around the Content Security Policy when writing Lightning Components?

2 Answers 2


Not at this time. Please file a bug or enhancement request so that it can be logged and considered.

  • Thanks, we're working with the Community product team and security at Salesforce on it. When we get some resolution i'll come back and post it. Oct 2, 2015 at 18:55
  • Please see my answer below, a patch has gone out addressing the problem. Oct 29, 2015 at 19:33

A patch went out over the last couple of weeks. There was no communication nor notice ( as far as I know ) about the patch.

However, third party Javascript should now be working in your Lightning-based communities. I have Live Agent and Google Analytics working in a community in a sandbox org.

I really wanted Websockets to work too but it appears the patch did not cover connect-src in the CSP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.