Questions tagged [csp]

The Lightning Component framework uses Content Security Policy (CSP), which is a W3C standard, to control the source of content that can be loaded on a page. CSP is a Candidate Recommendation of the W3C working group on Web Application Security. The framework uses the Content-​Security-​Policy HTTP header recommended by the W3C.

Filter by
Sorted by
Tagged with
0
votes
0answers
17 views

Refused to frame test.abc.com because an ancestor violates the following CSP directive: frame-ancestors

I have a detailed page button to load a visualforce page in new window. I added this button to Lightning actions in page layout. When I visit record details in lightning and click on this button, it ...
0
votes
0answers
33 views

Summer'20 Release - Salesforce Communities - CSP Error in Chrome

I have a Customer Community login page which is using a lightning aura component. Login page has a section where user enters username and password and logs in. After Summer'20 release, the section to ...
1
vote
1answer
33 views

How to configure RemoteSiteSetting and CsPTrustedSite metadata?

I am creating a Lightning Web Component which calls an external API to show the data on work.com Command Center. I want to distribute this component on AppExchange as a managed app. I found the ...
1
vote
1answer
28 views

Salesforce CSP site issue

Hi i have defined the few sites in the salesforce CSP settings but still i am getting the error as Refused to frame '' because it violates the following Content Security Policy directive all ...
1
vote
0answers
79 views

Can't connect lightning aura component with Google tag manager

I have a lightning component which I'm trying to connect with Tag Manager. I followed the instructions in the tag manager page, first saved the js code as a static resource then called that script ...
2
votes
1answer
63 views

Communities Builder: Header Markup: adding communities url to script src tag? “Build Your Own” template

We recently created a new "Build Your Own" template community in our sandbox and we were adding our script snippets in the builder for our analytics tool (click the settings cog -> advanced -> edit ...
1
vote
0answers
155 views

Display base64 data in Iframe Not working in lightning experience

We have a requirement to show google drive contents(pdf,txt,docs,xlsx,images) in a modal in lightning experience. Below is what I did so far: 1) Get the base64 content of the drive file using Apex ...
1
vote
0answers
113 views

Content Security Policy in Embedded Service's Post-chat VF page

Hi Salesforce community! I have set up an embedded service with a Post-chat page, which is overriden by a simple Visualforce page. The VF page code is very simple: <apex:page showHeader="false"&...
0
votes
1answer
182 views

Lightning Maps Not Working in Communities - [Solved]!

The following problem persists when loading a lightning:map in a community page: Refused to frame 'https://maps.a.forceusercontent.com/' because it violates the following Content Security Policy ...
0
votes
0answers
34 views

iframes and custom domain names in lightning community

I am running into an issue in a lightning community where we need to use an iframe to load a visualforce page (yes, it needs to be an iframe and not a lightning:container). The issue I'm running into ...
1
vote
1answer
414 views

CSP Issue when trying to bring in a React app to a lightning container

I have a simple aura component with a lightning container: <aura:component access="global" implements="flexipage:availableForAllPageTypes"> <lightning:container aura:id="ReactApp" src="{...
2
votes
0answers
85 views

Way to bypass CSP limitations

We store images of our customers in Google Drive. Way we merge data is by Rest API calls. Also, we provide our managers with custom lightning component with embeded links to the images. Unfortunately, ...
0
votes
1answer
444 views

Getting error while adding a trusted site

I am adding some markup in "Head Markup" section of Community Builder(Settings --> Advanced) that references resources from 3rd party websites. Thus, SFDC gives me CSP violation warning in the markup. ...
5
votes
1answer
165 views

CSP violation when trying to whitelist site

I'm going through the Build a Community with Knowledge and Chat module on trailhead and keep getting the same CSP violation when I try to whitelist the snap-in chat in the community builder. I have ...
0
votes
1answer
386 views

Adding 'self', 'unsafe-inline' and 'unsafe-eval' in manifest file of quip live app

I am creating an app which refers to Desmos graphical calculator api script. I have imported the script in my quip app directory. When I build my app and import it in my quip document it fails to load ...
0
votes
1answer
177 views

Showing youtube video tiles in Lightning web components

I am currently migrating a vf page into Lightning web component, the vf page used to show the youtube video tiles on the page. But when I am converting it into a LWC component then it is throwing ...
2
votes
0answers
118 views

Spring '19 changes to Lightning communities CSP and visualforce pages

Before Spring '19 we were relying on a Visualforce page included in an iframe inside a Lightning community to load static HTML content. That worked without any issue. It still does when the community ...
0
votes
1answer
244 views

Adding meta tab for CSP issues in lighting web component

I am using some MDN to load styles and fonts from google but in it is throwing error in the console. lwc_engine.js:6242 Refused to load the stylesheet 'https://www.google.com/recaptcha/api.js' ...
4
votes
3answers
2k views

How to Use lightning Locker Service in sandbox

I know how to configure security model through OWD, Sharing Rules, Profiles and Roles in salesforce sandbox account but how to use Lightning Security Locker Service instead of OWD, Sharing Rules...etc ...
0
votes
2answers
2k views

Make HTTP POST request from Lightning Component

I want to make a post request to a server, using this code: ({ start : function(component, event, helper) { var xhr = new XMLHttpRequest(); var url = "https://site.com/service"; ...
2
votes
3answers
2k views

Content Security Policy (CSP) of lightning:container

I'm trying to add custom CSP as given in the link: https://developer.salesforce.com/docs/atlas.en-us.lightning.meta/lightning/container_csp.htm index.html <!DOCTYPE html> <html lang="en">...
0
votes
2answers
2k views

Lighting:container - Refused to load the script 'https://www.youtube.com/iframe_api' because it violates the following Content Security Policy

The below is a React Component that I'm loading from lightning:container import React, { Component } from 'react'; import Plyr from 'plyr'; import '../node_modules/plyr/dist/plyr.css'; import './App....
2
votes
1answer
1k views

New CSP violation spontainiously happening in lightning

I have some code in a visualforce page that used a custom js library to build an excel file client side from an object generated on the server side and then force the browser to download the file. ...
1
vote
0answers
286 views

Enabling CSP unsafe-eval support on other origins

I'm trying to build a component utilising lightning:component (external build) which has a dependency that loads code on init via a script tag. Specifically I'm trying to load content from https://...
0
votes
1answer
93 views

How Can I Integrate the Flickr API with a Lightning App?

I'm presently working my way through Learning JavaScript Design Patterns by Addy Osmani, and trying to figure out how I can make these patterns functional and/or useful in the Salesforce Aura/...