CspTrustedSite

Represents a CSP Trusted Site. The Lightning Component framework uses Content Security Policy (CSP) to impose restrictions on content. The main objective of CSP is to help prevent cross-site scripting (XSS) and other code injection attacks. To use third-party APIs that make requests to an external (non-Salesforce) server or to use a WebSocket connection, add the server as a CSP Trusted Site. This type extends the Metadata metadata type and inherits its fullName field.

Declarative Metadata File Suffix and Directory Location

CspTrustedSite components are stored in the cspTrustedSites directory of the corresponding package directory. The file name matches the unique name of the trusted site, and the extension is .cspTrustedSite.

Version

CspTrustedSite components are available in API version 39.0 and later.

Fields

Field	Field Type	Description
context	CspTrustedSiteContext (enumeration of type string)	Declares the scope of trust for the listed third-party host. `All` allows the host for all supported context types. `Communities` allows the host for Experience Builder sites only. `FieldServiceMobileExtension` allows the host for the Field Service Mobile Extensions only. This value is available in API version 47.0 and later. `LEX` allows the host for Lightning Experience pages only. `VisualForce` allows the host for custom Visualforce pages only. This value is available in API version 55.0 and later. For custom Visualforce pages, content is restricted to CSP Trusted Sites only if the page’s `cspHeader` attribute is set to `true`. This field is available in API version 44.0 and later.
description	string	The description explaining what this trusted site is used for.
endpointUrl	string	Required. The URL for the trusted site.
isActive	boolean	Required. Indicates if the trusted site is active (`true`) or not (`false`).
isApplicableToConnectSrc	boolean	Indicates if Lightning components can load URLs using script interfaces from this site (`true`) or not (`false`). This field has a default value of `false`. At least one CspTrustedSite field beginning with isApplicable must be set to `true`. In API version 50.0 and later, if all isApplicable fields are `false`, the isApplicableToImgSrc field is set to `true`. In API version 49.0 and earlier, if all isApplicable fields are `false`, these fields all default to `true`. Note This field is available in API version 48.0 and later.
isApplicableToFontSrc	boolean	Indicates if Lightning components can load fonts from this site (`true`) or not (`false`). This field has a default value of `false`. At least one CspTrustedSite field beginning with isApplicable must be set to `true`. In API version 50.0 and later, if all isApplicable fields are `false`, the isApplicableToImgSrc field is set to `true`. In API version 49.0 and earlier, if all isApplicable fields are `false`, these fields all default to `true`. Note This field is available in API version 48.0 and later.
isApplicableToFrameSrc	boolean	Indicates if Lightning components can load resources contained in `<iframe>` elements from this site (`true`) or not (`false`). This field has a default value of `false`. At least one CspTrustedSite field beginning with isApplicable must be set to `true`. In API version 50.0 and later, if all isApplicable fields are `false`, the isApplicableToImgSrc field is set to `true`. In API version 49.0 and earlier, if all isApplicable fields are `false`, these fields all default to `true`. Note This field is available in API version 48.0 and later.
isApplicableToImgSrc	boolean	Indicates if Lightning components can load images from this site (`true`) or not (`false`). This field has a default value of `false`. At least one CspTrustedSite field beginning with isApplicable must be set to `true`. In API version 50.0 and later, if all isApplicable fields are `false`, the isApplicableToImgSrc field is set to `true`. In API version 49.0 and earlier, if all isApplicable fields are `false`, these fields all default to `true`. Note This field is available in API version 48.0 and later.
isApplicableToMediaSrc	boolean	Indicates if Lightning components can load audio and video from this site (`true`) or not (`false`). This field has a default value of `false`. At least one CspTrustedSite field beginning with isApplicable must be set to `true`. In API version 50.0 and later, if all isApplicable fields are `false`, the isApplicableToImgSrc field is set to `true`. In API version 49.0 and earlier, if all isApplicable fields are `false`, these fields all default to `true`. Note This field is available in API version 48.0 and later.
isApplicableToStyleSrc	boolean	Indicates if Lightning components can load style sheets from this site (`true`) or not (`false`). This field has a default value of `false`. At least one CspTrustedSite field beginning with isApplicable must be set to `true`. In API version 50.0 and later, if all isApplicable fields are `false`, the isApplicableToImgSrc field is set to `true`. In API version 49.0 and earlier, if all isApplicable fields are `false`, these fields all default to `true`. Note This field is available in API version 48.0 and later.
mobileExtension	string	Reserved for future use.

Declarative Metadata Sample Definition

A sample XML definition of a trusted site is shown below.

Usage

CSP is a W3C standard that defines rules to control the source of content that can be loaded on a page. All CSP rules work at the page level, and apply to all components and libraries. By default, the framework’s headers allow content to be loaded only from secure (HTTPS) URLs and forbid XHR requests from JavaScript.

When you configure a CSP Trusted Site, you can add the site’s URL to the list of allowed sites for the following directives in the CSP header.

connect-src
frame-src
img-src
style-src
font-src
media-src

This change to the CSP header directives allows Lightning components to load resources, such as images, styles, and fonts, from the site. It also allows client-side code to make requests to the site.

Wildcard Support in the Manifest File

This metadata type supports the wildcard character * (asterisk) in the package.xml manifest file. For information about using the manifest file, see Deploying and Retrieving Metadata with the Zip File.

Metadata API Developer Guide