Because of the Content Security Policy set when using Lightning components there I haven't found a way to include a Live Agent deployment as part of a Community built using the Winter '16 Community Builder. The same issue prevents Google Analytics from working too.

Is there a way around the Content Security Policy when writing Lightning Components?

2 Answers 2


Not at this time. Please file a bug or enhancement request so that it can be logged and considered.

  • Thanks, we're working with the Community product team and security at Salesforce on it. When we get some resolution i'll come back and post it. Oct 2, 2015 at 18:55
  • Please see my answer below, a patch has gone out addressing the problem. Oct 29, 2015 at 19:33

A patch went out over the last couple of weeks. There was no communication nor notice ( as far as I know ) about the patch.

However, third party Javascript should now be working in your Lightning-based communities. I have Live Agent and Google Analytics working in a community in a sandbox org.

I really wanted Websockets to work too but it appears the patch did not cover connect-src in the CSP.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .