Baucore

Content Security Policy (CSP) Updates for Maps

Taskadmin

Salesforce enforces stricter Content Security Policy (CSP) directives to protect against cross-site scripting (XSS) and other code injection attacks. This affects how externally hosted fonts, images, and iframes are handled in Salesforce Lightning pages — including the Baucore Maps component, which is powered by Google Maps.

If your org uses the Maps component, you need a CSP Trusted Site entry for it to keep working.

This update is enforced for all organizations using Lightning Experience, including Enterprise, Performance, Developer, and Unlimited editions. Organizations created in Summer ‘24 or later already have it enabled by default.

Add the required Trusted Site

  1. Go to Setup.

  2. In the Quick Find box, search for CSP Trusted Sites.

  3. Add the following URL as a trusted domain under the frame-src (iframes) context:

    https://apps-api.ibs-technology.com

  4. Ensure iframe content is specifically allowed for this domain so the Maps component can keep loading it.

Why this is necessary

Salesforce’s CSP directives block externally hosted content — fonts, images, and iframes — unless it’s explicitly trusted. Adding this domain to CSP Trusted Sites keeps the Maps component’s Google Maps content loading without interruption.

Still need help?

Our support team is happy to help with anything not covered here.

Contact support