CspTrustedSite

Represents a CSP Trusted Site. The Lightning Component framework uses Content Security Policy (CSP) to impose restrictions on content. The main objective is to help prevent cross-site scripting (XSS) and other code injection attacks. To use third-party APIs that make requests to an external (non-Salesforce) server or to use a WebSocket connection, add a CSP Trusted Site. This object is available in API version 48.0 and later.

Supported Calls

create(), delete(), describeSObjects(), query(), retrieve(), update(), upsert()

Fields

Field	Details
Context	Type picklist Properties Create, Filter, Group, Restricted picklist, Sort, Update Description Declares the scope of trust for the listed third-party host. Possible values are: `All`—Whitelists the host for both Lightning Experience and Experience Builder sites. `Communities`—Whitelists the host for Experience Builder sites only. `FieldServiceMobileExtension`—Whitelists the host for the Field Service Mobile Extensions only. `LEX`—Whitelists the host for Lightning Experience only.
Description	Type textarea Properties Create, Filter, Group, Nillable, Sort, Update Description The description of the trusted site. Limit: 255 characters.
DeveloperName	Type string Properties Create, Filter, Group, Sort, Update Description The developer name of the trusted site. Only users with View DeveloperName OR View Setup and Configuration permission can view, group, sort, and filter this field. Note
EndpointUrl	Type string Properties Create, Filter, Group, Sort, Update Description The URL for the trusted site.
IsActive	Type boolean Properties Create, Defaulted on create, Filter, Group, Sort, Update Description Indicates whether the trusted site is active.
IsApplicableToConnectSrc	Type boolean Properties Create, Defaulted on create, Filter, Group, Sort, Update Description Indicates if Lightning components can load URLs using script interfaces from this site.
IsApplicableToFontSrc	Type boolean Properties Create, Defaulted on create, Filter, Group, Sort, Update Description Indicates if Lightning components can load fonts from this site.
IsApplicableToFrameSrc	Type boolean Properties Create, Defaulted on create, Filter, Group, Sort, Update Description Indicates if Lightning components can load resources contained in `<iframe>` elements from this site.
IsApplicableToImgSrc	Type boolean Properties Create, Defaulted on create, Filter, Group, Sort, Update Description Indicates if Lightning components can load images from this site.
IsApplicableToMediaSrc	Type boolean Properties Create, Defaulted on create, Filter, Group, Sort, Update Description Indicates if Lightning components can load audio and video from this site.
IsApplicableToStyleSrc	Type boolean Properties Create, Defaulted on create, Filter, Group, Sort, Update Description Indicates if Lightning components can load style sheets from this site.
Language	Type picklist Properties Create, Defaulted on create, Filter, Group, Nillable, Restricted picklist, Sort, Update Description The language for the trusted site.
MasterLabel	Type string Properties Create, Filter, Group, Sort, Update Description Master label for this trusted site.
NamespacePrefix	Type string Properties Filter, Group, Nillable, Sort Description Namespace prefix for this trusted site.

Usage

CSP is a W3C standard that defines rules to control the source of content that can be loaded on a page. All CSP rules work at the page level, and apply to all components and libraries. By default, the framework’s headers allow content to be loaded only from secure (HTTPS) URLs and forbid XHR requests from JavaScript.

When you define a CSP Trusted Site, you can add the site’s URL to the list of allowed sites for the following directives in the CSP header.

connect-src
frame-src
img-src
style-src
font-src
media-src

This change to the CSP header directives allows Lightning components to load resources, such as images, styles, and fonts, from the site. It also allows client-side code to make requests to the site.

Object Reference for Salesforce and Lightning Platform

CspTrustedSite

Supported Calls

Fields

Usage