Clayton

Content Security Policy (CSP) is a standard used to prevent attacks from malicious content in &nbsp;trusted web pages. The Lightning Framework enforces CSP for technical reasons, however developers should always assume CSP is in place and fetch &nbsp;content from trusted sources at all times.

Enforcement. Use strict if you want to ensure that any resource is stored as Salesforce static resource and served by Salesforce itself. Use normal if you want to ensure that any external resource is referenced securely (using HTTPS)

- Enforcement. Use strict if you want to ensure that any resource is stored as Salesforce static resource and served by Salesforce itself. Use normal if you want to ensure that any external resource is referenced securely (using HTTPS)

- Lightning components
- Visualforce pages
- Visualforce components

<a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP" rel="nofollow noopener noreferrer" target="_blank">MDN Web Docs: Content Security Policy (CSP)</a>

- <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP" rel="nofollow noopener noreferrer" target="_blank">MDN Web Docs: Content Security Policy (CSP)</a>

Make sure that resources used by Visualforce or Lightning components are retrieved securely in accordance to your Content Security Policy.

Content Security Policy (CSP)

Rationale

Configuration

Scope

See also