CSP and Lightning Locker to combat XSS and clickjacking

Security doesn’t stop with access or mere record visibility. The very components on your page can put your site at risk if they’re not carefully coded, protected, and monitored. There are many methods that malicious parties can use to leverage poor code on your site to work their way into your systems, but most of them broadly involve emulating part of your site code to infiltrate code on the rest of your site and/or extract sensitive information from your users. Even though Salesforce has a lot of declarative “kill switches” to isolate certain attacks that most unmanaged software doesn’t come with, we still have to think through our security set up. Lucky for us, the implementation of many of these security best practices is easily configurable using settings within Salesforce. We will review clickjacking later in this chapter; let’s start with the CSP.

How to set a CSP

A CSP is...