---
schema_version: "1"
id: 30aa023116320b8e809f37cd0552a91cd91ee7ef67853e6d14c9977b4a4dfc22
title: Content Security Policy Overview
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/lwc/lightning-components-security/guides/content-security-policy/content-security-policy-intro.md
canonical_url: https://developer.salesforce.com/docs/platform/lightning-components-security/guide/content-security-policy-intro.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 48ad660d09c6775f8b75adab5e805d79bcb1e43d3e5ae96a6e33b87d17ae3376
products:
  - Security for Lightning Components
  - lwc
---
# Content Security Policy Overview

The Lightning Component framework uses Content Security Policy ([CSP](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP)) to impose restrictions on content. The main objective is to help prevent cross-site scripting ([XSS](https://developer.salesforce.com/docs/platform/lightning-components-security/guide/%3Chttps://www.owasp.org/index.php/Cross-site_Scripting_(XSS)>)) and other code injection attacks.

CSP is a W3C standard that defines rules to control the source of content that can be loaded on a page. All CSP rules work at the page level, and apply to all components and libraries. Web browsers follow CSP rules specified in web page headers to block requests to unknown servers for resources including scripts, images, and other data. CSP directives also apply to client-side JavaScript, for example by restricting inline JavaScript in HTML.

The framework enables these specific CSP rules:

- JavaScript libraries can only be referenced from your org

  - : All external JavaScript libraries must be uploaded to your org as static resources. The `script-src 'self'` directive requires script source to be called from the same origin. For developing Lightning web components, see [Use Third-Party JavaScript Libraries](/docs/platform/lwc/guide/js-third-party-library.html). For developing Aura components, see [Using External JavaScript Libraries](https://developer.salesforce.com/docs/atlas.en-us.lightning.meta/lightning/js_libs_platform.htm).

- Resources must be located in your org by default

  - : The `font-src`, `img-src`, `media-src`, `frame-src`, `style-src`, and `connect-src` directives are set to `'self'`. As a result, resources such as fonts, images, videos, frame content, CSS, and scripts must be located in the org by default.

    You can change the CSP directives to permit access to third-party resources by adding trusted URLs (previously CSP Trusted Sites). For more information, see [Manage Trusted URLs](https://help.salesforce.com/s/articleView?id=sf.security_trusted_urls_manage.htm).

    You can’t change the protocol from HTTPS to HTTP for these resources, however.

- HTTPS connections for resources

  - : All references to external fonts, images, frames, and CSS must use an HTTPS URL. This requirement applies whether the resource is located in your org or accessed through a trusted URL.

- Inline JavaScript disallowed

  - : Script tags can’t be used to load JavaScript, and event handlers can’t use inline JavaScript. The `unsafe-inline` source for the `script-src` directive is disallowed. For example, this attempt to use an event handler to run an inline script is prevented:

    ```html
    <button onclick="doSomething()"></button>
    ```

## Browser Support

Not all browsers enforce CSP. For a list of browsers that enforce CSP, see [`caniuse.com`](http://caniuse.com/contentsecuritypolicy).

## Finding CSP Violations

CSP policy violations are logged in the browser’s developer console. If your app’s functionality isn’t affected, you can ignore the CSP violation.

This message is a sample violation.

```
Refused to load the script 'https://externaljs.docsample.com/externalLib.js'
because it violates the following Content Security Policy directive: ...
```