I'm a new dev so feel free to scrutinize everything I post because I need to learn.

So I have a component and am utilizing a helper to send some data to one of our company's external sites using jQuery's POST method.

 $j = jQuery.noConflict();
           var prospieId = response.getReturnValue().Id;
           var fname = response.getReturnValue().First_Name__c;
           var lname = response.getReturnValue().Last_Name__c;
           var hphone = response.getReturnValue().Home_Phone__c;
           var wphone = response.getReturnValue().Work_Phone__c;
           var mphone = response.getReturnValue().Mobile_SMS_Phone__c;
           var email = response.getReturnValue().Personal_Email__c;
           var state = response.getReturnValue().State__c;
           var zip = response.getReturnValue().Postal_Code__c;

               url: "https://companyname.website.com/post/e892b49b8412a5389b/",
               data: "firstname="+fname+"&lastname="+lname+"&phone="+hphone+"&phone2="+wphone+"&phone3="+mphone+"&email="+email+"&state="+state+"&zip="+zip+"&_ZIPLOOKUP="+zip+"&tp_id="+prospieId

The error I receive when I try to view my console is this:

Refused to connect to 'https://company.website.com/post/e892b49b8412a5389b/' because it violates the following Content Security Policy directive: "connect=src 'self'".

Console Error Screenshot

I did try to add this URL in the Remote Site Settings in the Security Controls section of the setup tree in Salesforce. I have a jQuery library saved as a static resource per the Lightning Dev Requirements and have called it in my parent component. Is there some other setting within Salesforce's security controls that I am missing?


HTTP callouts are blocked by CSP (Contend Security Policy) by salesforce on purpose. The reason behind this are security concerns. You can try to make the callout in an serverside apex controller.

  • 1
    Yea, we also can't manage offline for you without you going through a controller action. RichardT is correct. – Kris Gray Oct 29 '15 at 23:39
  • You can try adding it as a Trusted Site. Go to Setup -> Security -> CSP Trusted Site, and here add your website as a trusted site. This worked for me like a charm. – julianm Nov 12 '19 at 19:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.