Questions tagged [content-security-policy]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
4 votes
1 answer
3k views

Refused to frame "vf.force.com/" because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self'"

--- Issue --- I have a LWC inside my Managed Package which dynamically opens a Visualforce Page by its name inside iframe. It worked ok in all orgs, However for the last 3-4 months I noticed that if ...
Vitalii Dehnerys's user avatar
0 votes
1 answer
35 views

Is request invocation from frontend javascript is secure and safe? What is the limit for file size when uploading files using Visualforce Javascript?

On one legacy project the following pattern was implemented. Visualforce page has div element with ondrop event handler which processes event.dataTransfer.files attribute to initiate FileReader with ...
Patlatus's user avatar
  • 16.4k
2 votes
1 answer
203 views

What happens at install time for Content Security Policy (CSP) Trusted Sites included in a package?

When Remote Site Settings are packaged, for manual installs there is a prompt at install time to confirm the add of those settings to the org. Looks like Content Security Policy (CSP) Trusted Sites ...
Keith C's user avatar
  • 136k
2 votes
0 answers
364 views

Content Block throws CSP error

We have a Content Block that we built with https://github.com/salesforce-marketingcloud/blocksdk. Since the last update we get this error message when opening the CB in the Email Editor: [Report Only]...
Philipp Wüthrich's user avatar
1 vote
0 answers
731 views

Display VF Page within iFrame in an Experience site for public use

I hope you are well! I have a flow, it runs some logic, before running a Lightning Web Component. This component is there only to hold a Visualforce page inside an iframe. In this VF page, I have all ...
DeoMc's user avatar
  • 31
0 votes
0 answers
804 views

Unescaped Attribute Value XSS in Aura Component

Salesforce ran SonarQube Code Quality on my org and there were several errors like 'Unescaped Attribute Value XSS' in the aura components. All these errors occur in component elements that call the ...
Marcus Vinicius's user avatar
1 vote
0 answers
314 views

How to add domains to script-src directive in salesforce?

When creating a new trusted domain in CSP Trusted Sites (your-domain-here/lightning/setup/SecurityCspTrustedSite/home), the script-src directive is missing from the list. How can we add our domains to ...
Evan's user avatar
  • 111
0 votes
0 answers
746 views

Profile does not have permission to Visualforce page but User able to access it

We have a bunch of Visualforce pages which are not supposed to viewed by some profile users. But they have access to the objects and field level access to all the objects involved in that VF page ...
AshSFcloud's user avatar
5 votes
1 answer
1k views

Lightning Container + CSP issue in Spring '21

I have a React app loading into a lightning-container from a static resource in both sandbox and production environments. This app has been humming along happily for a year without security issues. As ...
Shawn Truesdell's user avatar
2 votes
0 answers
874 views

CORS Policy Error with Third Party Javascript Library

I'm trying to build my own Google Maps LWC. I understand and am aware that there is a native Lightning Map component, but I am wishing to build my own, and utilizing my own billing independent of ...
Kyle B.'s user avatar
  • 223
1 vote
0 answers
217 views

Summer'20 Release - Salesforce Communities - CSP Error in Chrome

I have a Customer Community login page which is using a lightning aura component. Login page has a section where user enters username and password and logs in. After Summer'20 release, the section to ...
Cloud Man's user avatar
  • 1,347
1 vote
1 answer
157 views

Salesforce CSP site issue

Hi i have defined the few sites in the salesforce CSP settings but still i am getting the error as Refused to frame '' because it violates the following Content Security Policy directive all ...
Tiina's user avatar
  • 11
2 votes
1 answer
1k views

Communities Builder: Header Markup: adding communities url to script src tag? "Build Your Own" template

We recently created a new "Build Your Own" template community in our sandbox and we were adding our script snippets in the builder for our analytics tool (click the settings cog -> advanced -> edit ...
Bob Burdekin's user avatar
7 votes
3 answers
22k views

Content security policy error while loading apex iframe

Issue: We get CSP (Content Security Policy) error with our Visualforce page integration. The issue is that when we access this in sandbox testing, we find that our content is wrapped in an iframe, ...
Raghvendra Parashar's user avatar
0 votes
0 answers
323 views

CSP Whitelisting Not Working in Scratch Org

I'm adding Google's reCAPTCHA element to a Lightning component. Following Google's documentation, I added this JS snippet to the community in my scratch org: <script src="https://www.google.com/...
Matt Smith's user avatar
1 vote
1 answer
123 views

Play .mov video from amazon in lightning

I want to play .mov video from amazon in lightning. Here is amazon presigned url: https://s3.us-east-1.amazonaws.com/zed-content/Activity%20Contents/test%20act%20Content/testVid47.MOV?X-Amz-...
iloveseven's user avatar
  • 1,115
2 votes
1 answer
937 views

Lightning does not allow to download a video

Here is the error I am getting: zced__View_RPG_Flow:1 Refused to load media from 'https://archive.org/download/BigBuckBunny_124/Content/big_buck_bunny_720p_surround.mp4' because it violates the ...
iloveseven's user avatar
  • 1,115
2 votes
0 answers
528 views

Lightning Component CSP - Meta tag http-equiv for TinyMCE

I have a lightning sub component within a larger component that uses TinyMCE js library locally to provide advanced editing capabilities. The component works when I disable LockerService, by setting ...
Richard Peute's user avatar
1 vote
0 answers
367 views

Lightning Out Content Security Policy

I'm trying to use Lightning Out. It's running from within an iFrame, but I'm getting this error. Refused to load the script 'https://XXX.my.salesforce.com/lightning/lightning.out.js' because it ...
brezotom's user avatar
  • 1,077
1 vote
0 answers
460 views

Enabling CSP unsafe-eval support on other origins

I'm trying to build a component utilising lightning:component (external build) which has a dependency that loads code on init via a script tag. Specifically I'm trying to load content from https://...
Ben Naylor's user avatar
3 votes
0 answers
7k views

Soap webservice callout throws "Policy Falsifed" error : Error code 500

I am trying to make a web service call to an external system. The Gateway to the application server needs a soap signed request (WSS Security). The service provider confirmed authetication happens ...
Bharadwaj Urma's user avatar
3 votes
0 answers
2k views

Frame Ancestors for Content Security Policy headers for Canvas App

I'm working on a canvas app. I need to prevent it from being iframed from unauthorized sources. The problem is I don't know what to set as the CSP frame-ancestors in the headers for my canvas app. It ...
Kody King's user avatar
2 votes
0 answers
231 views

Sandbox Marketing Banner Blocked by Content Security Policy

I was logging in to the sandbox today and I noticed that instead of the usual marketing banner I got an error message saying: Blocked by Content Security Policy This page has a content security ...
martin's user avatar
  • 12.6k
0 votes
1 answer
1k views

Display a page in an iframe from a diferent domain

I am trying to build a simple visualforce page with an iframe. my page: <apex:page> <apex:iframe src="http://my.website.com" scrolling="true" id="theIframe"/> </apex:page> ("...
RealGigex's user avatar
  • 175
2 votes
0 answers
591 views

Salesforce Lightning App + Microsoft Edge + CSP

I am currently developing a Lightning Application and have predominately being using Google Chrome through the development process. I am now working to ensure that the application is supported across ...
techbusinessman's user avatar