CspTrustedSite

Represents a CSP Trusted Site. The Lightning Component framework uses Content Security Policy (CSP) to impose restrictions on content. The main objective is to help prevent cross-site scripting (XSS) and other code injection attacks. To use third-party APIs that make requests to an external (non-Salesforce) server or to use a WebSocket connection, add a CSP Trusted Site.

Declarative Metadata File Suffix and Directory Location

CspTrustedSite components are stored in the cspTrustedSites directory of the corresponding package directory. The file name matches the unique name of the trusted site, and the extension is .cspTrustedSite.

Version

CspTrustedSite components are available in API version 39.0 and later.

Fields

Field	Field Type	Description
context	CspTrustedSiteContext (enumeration of type string)	Declares the scope of trust for the listed third-party host. `All` whitelists the host for both Lightning Experience and Lightning Communities experience. `Communities` whitelists the host for Lightning Communities experience only. (Default) `LEX` whitelists the host for Lightning Experience only. This field is available in API version 44.0 and later.
description	string	The description explaining what this trusted site is used for.
endpointUrl	string	Required. The URL for the trusted site.
isActive	boolean	Required. Indicates if the trusted site is active (`true`) or not (`false`).

Declarative Metadata Sample Definition

A sample XML definition of a trusted site is shown below.

1<?xml version="1.0" encoding="UTF-8"?>
2<CspTrustedSite xmlns="http://soap.sforce.com/2006/04/metadata">
3    <description>Used for Lightning component callout to mapping web service</description>
4    <endpointUrl>https://www.maptestsite.net/</endpointUrl>
5    <isActive>true</isActive>    <context>LEX</context>
6</CspTrustedSite>

Usage

CSP is a W3C standard that defines rules to control the source of content that can be loaded on a page. All CSP rules work at the page level, and apply to all components and libraries. By default, the framework’s headers allow content to be loaded only from secure (HTTPS) URLs and forbid XHR requests from JavaScript.

When you define a CSP Trusted Site, the site’s URL is added to the list of allowed sites for the following directives in the CSP header.

connect-src
frame-src
img-src
style-src
font-src
media-src

This change to the CSP header directives allows Lightning components to load resources, such as images, styles, and fonts, from the site. It also allows client-side code to make requests to the site.

You can’t load JavaScript resources from a third-party site, even if it’s a CSP Trusted Site. To use a JavaScript library from a third-party site, add it to a static resource, and then add the static resource to your component. After the library is loaded from the static resource, you can use it as normal.

Important

Metadata API Developer Guide