aibot88 CSP and Trusted URLs
Salesforce enforces strict CSP for Lightning and LWR. External scripts, connect-src targets, and frame-src must be allow-listed via Trusted URLs (Setup → Security → Trusted URLs). This skill maps each context (Lightning Experience, Experience Cloud LWR, Lightning Communities) to the right directive.
When to Use
Before adding an LWC or Aura component that calls a non-Salesforce endpoint, pulls a third-party library, or frames a partner site. Not for server-side callouts — use Named Credentials + Remote Site Settings.
Typical trigger phrases that should route to this skill: script refused to load salesforce csp, add trusted url for external api, lwc fetch third party blocked, csp trusted sites lightning.
Recommended Workflow
- Identify the failing directive: connect-src, script-src, img-src, frame-src, font-src.
- Setup → Trusted URLs → New. Enter the URL, context (Lightning Experience / Experience Cloud LWR / Communities), and check the relevant directive boxes.
- Reload the page; verify the console CSP violation is gone.
- Document the external dependency in your architecture diagram + security review.
- Remove entries quarterly when features are retired.
Key Considerations
- Trusted URL is per context — a URL trusted in LEX is not automatically trusted in LWR.
- script-src with inline handlers (onclick=) is not allowed; refactor to LWC event listeners.
- Remote Site Settings govern Apex callouts; Trusted URL governs browser-side fetch.
- Salesforce generates a hash for each CSP-allowed script; use the SFDC-provided cdn when possible to reduce allow-list size.
Worked Examples (see references/examples.md)
- Add Stripe.js to an LWC checkout — B2C LWR site.
- Call internal analytics API from Lightning — LEX dashboard.
Common Gotchas (see references/gotchas.md)
- Wildcard subdomains — https://*.corp.com trusts unintended hosts.
- LWR vs. LEX confusion — Same URL added for wrong context silently fails.
- CDN churn — Script URL changes version and the allow-list breaks.
Top LLM Anti-Patterns (full list in references/llm-anti-patterns.md)
- Using wildcards 'https://*'
- Disabling CSP ('Relaxed CSP') to ship faster
- Allow-listing a script URL without also allow-listing its connect-src dependencies
Official Sources Used
- Apex Developer Guide — Sharing — https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_bulk_sharing_understanding.htm
- Salesforce Security Guide — https://help.salesforce.com/s/articleView?id=sf.security.htm
- Shield Platform Encryption — https://help.salesforce.com/s/articleView?id=sf.security_pe_overview.htm
- Session Security Levels — https://help.salesforce.com/s/articleView?id=sf.security_hap_session.htm
- CSP and Trusted URLs — https://help.salesforce.com/s/articleView?id=sf.security_csp_overview.htm
- API Only User Profile — https://help.salesforce.com/s/articleView?id=sf.users_profiles_api_only.htm
- Privacy Center and DSR — https://help.salesforce.com/s/articleView?id=sf.privacy_center_overview.htm