Skip Navigation

Lightning Aura Components Developer Guide

Clouds with binary code floating aboveCloud with binary code floating above

No Results

Search Tips:

  • Please consider misspellings
  • Try different search keywords
Introducing Aura Components
Quick Start
Creating Components
Using Components
Communicating with Events
Communicating Across the DOM with Lightning Message Service
Creating Apps
Styling Apps
Developing Secure Code
Using JavaScript
Supported JavaScript
Invoking Actions on Component Initialization
Sharing JavaScript Code in a Component Bundle
Sharing JavaScript Code Across Components
Using External JavaScript Libraries
Dynamically Creating Components
Detecting Data Changes with Change Handlers
Finding Components by ID
Working with Attribute Values in JavaScript
Working with a Component Body in JavaScript
Working with Events in JavaScript
Modifying the DOM
Checking Component Validity
Modifying Components Outside the Framework Lifecycle
Throwing and Handling Errors
Calling Component Methods
Dynamically Adding Event Handlers To a Component
Dynamically Showing or Hiding Markup
Adding and Removing Styles
Which Button Was Pressed?
Formatting Dates in JavaScript
Using JavaScript Promises
Making API Calls from Components
Control Access to Browser Features
Manage Trusted URLs
Working with Salesforce Data
Testing Components
Debugging
Performance
Reference
PDF

Manage Trusted URLs

Specify the URLs that you trust to interact with your users and network. Use Content Security Policy (CSP) directives to control the types of resources that Lightning components, third-party APIs, and WebSocket connections can load from each trusted URL. If you enabled the Permissions-Policy HTTP header in Session Settings, you can also control which URLs can access browser features from Salesforce.
Available in: Salesforce Classic and Lightning Experience
Available in: Enterprise, Performance, Developer, and Unlimited Editions

User Permissions Needed
To create, read, update, and delete trusted URLs: Customize Application AND Modify All Data

For each trusted URL in Setup, you can specify CSP directives and Permissions-Policy directives. To specify the external URLs to which users can be redirected from Salesforce, see Manage Redirections to External URLs. To allow external sites to load your Visualforce pages or surveys in an inline frame (iframe), see Specify Trusted Domains for Inline Frames.

To support integration across Salesforce products, Salesforce includes URLs in each CSP directive, even though those URLs aren’t defined as trusted URLs. Salesforce regularly updates those URLs based on the latest requirements.

Note

Add or Edit a Trusted URL

For each trusted URL in Setup, you can specify Content Security Policy (CSP) directives and Permissions-Policy directives.
  1. From Setup, in the Quick Find box, enter Trusted URLs, and then select Trusted URLs.
    The Trusted URLs Setup page
  2. To add a new trusted URL, click New Trusted URL.
  3. To edit an existing trusted URL, click Edit.
  4. If you’re adding a trusted URL, enter the API Name.

    Enter only underscores and alphanumeric characters. The name must be unique, begin with a letter, not include spaces, not end with an underscore, and not contain two consecutive underscores.

    If you edit the API name of an existing trusted URL, review your code and update references to the previous API name.

  5. Edit or enter the URL.

    The trusted URL must include a domain name and can include a port. For example, https://example.com or https://example.com:8080.

    To reduce repetition, you can use the wildcard character * (asterisk). For example, *.example.com.

    For a third-party API, the URL must begin with https://. For example, https://example.com.

    For a WebSocket connection, the URL must begin with wss://. For example, wss://example.com.

  6. Optionally, enter or edit a description for the trusted URL.
  7. Optionally, to temporarily disable this trusted URL, deselect Active.
  8. Specify at least one CSP directive or permissions policy directive for the trusted URL, and then save your changes.

Specify CSP Directives for a Trusted URL

To help prevent cross-site scripting (XSS) and other code injection attacks, the Lightning component framework uses Content Security Policy (CSP) to impose restrictions on content. By default, the framework’s headers allow content to be loaded only from secure (HTTPS) URLs and forbid XHR requests from JavaScript. To use third-party APIs that make requests to an external (non-Salesforce) server or to use a WebSocket connection, add the server as a Trusted URL.

To enable the corresponding access for Apex, create a remote site.

Not every browser enforces CSP. For a list of browsers that enforce CSP, see caniuse.com

Note

  1. From Setup, in the Quick Find box, enter Trusted URLs, and then select Trusted URLs.

    You define the CSP context and directives in the Content Security Policy (CSP) Settings section of the Trusted URL page.

    The CSP Settings section of the Trusted URL page.
  2. To control which pages can load content from this trusted URL, select the CSP context.
    1. To apply the CSP directives to all supported context types, select All. This context is the default.
    2. To apply the CSP directives to Experience Cloud sites only, select Experience Builder Sites.
    3. To apply the CSP directives to Lightning Experience pages only, select Lightning Experience pages.
    4. To apply the CSP directives to your custom Visualforce pages only, select Visualforce Pages.

    For custom Visualforce pages, content is restricted to CSP Trusted Sites only if the page’s cspHeader attribute is set to true.

    To specify CSP directives for one URL with two of the three CSP contexts, create two trusted URL records with different API names.

    Tip

  3. Select the CSP directives for this trusted URL. Each CSP directive controls access to a resource type. Lightning components can load the resources within Lightning or within your CSP-secured Aura or LWR sites.
    1. To allow Lightning components, third-party APIs, and WebSocket connections to load URLs that use script interfaces from this trusted URL, select connect-src (scripts).

      To use the Salesforce Console Integration Toolkit from within a trusted URL, also add the trusted URL in the Security settings of Experience Builder for your Visualforce sites. Otherwise, you can’t load JavaScript resources from a third party, even if it’s a trusted URL.

      To use a JavaScript library from a third party, add the library to a static resource, and then add the static resource to your component.

      Note

    2. To allow Lightning components, third-party APIs, and WebSocket connections to load fonts from this trusted URL, select font-src (fonts).
    3. To allow Lightning components, third-party APIs, and WebSocket connections to load resources contained in <iframe> elements from this trusted URL, select frame-src (iframe content).
    4. To allow Lightning components, third-party APIs, and WebSocket connections to load images from this trusted URL, select img-src (images). This option is enabled by default.
    5. To allow Lightning components, third-party APIs, and WebSocket connections to load audio and video from this trusted URL, select media-src (audio and video).
    6. To allow Lightning components, third-party APIs, and WebSocket connections to load style sheets from this trusted URL, select style-src (stylesheets).
  4. After you save your changes, validate the header size for your Aura sites.
    For Aura sites in Experience Cloud, if the HTTP header size is greater than 8 KB, the directives are moved from the CSP header to the <meta> tag. To avoid errors from infrastructure limits, we recommend that the header size doesn’t exceed 3 KB per CSP context.

Grant a Trusted URL Access to Browser Features

Select the permissions policy directives for a trusted URL. Each directive grants the trusted URL access to a browser feature.

To use this feature, enable the Permissions-Policy header in Session Settings. You can control access to a browser feature at the trusted URL level only when access for the corresponding feature is set to Trusted URLs Only in Session Settings.

  1. Add or edit a trusted URL.

    You grant access to browser features in the Permissions Policy Directives section of the Trusted URL page.

    The Permissions Policy Directives section of the Trusted URLs page.
  2. To grant this trusted URL permission access to the user’s camera, select camera.
  3. To grant this trusted URL permission access to the user’s camera, select microphone.