LWCIntermediateexperience-cloudsecuritycsp
Audit Experience Cloud LWC for CSP and third-party script violations
Real World Scenario
Marketing embeds analytics script in LWC static resource. CSP blocks script in production LWR site breaking tracking and console errors.
Expected Answer
• Review CSP allowlist in Experience Builder site settings
• Prefer platform analytics over third-party script injection
• loadScript only for approved static resources not remote CDN in Locker
• CSP report-uri monitoring for blocked script alerts
• Separate internal vs community component variants without external scripts
• Security review checklist item: third-party script in LWC
• Test production CSP not only local LWC OSS dev server
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Main difference: use case and scale. Review CSP allowlist in Experience Builder site settings. Prefer platform analytics over third-party script injection. Pick based on your integration pattern and team capability. Community CSP is stricter than internal Lightning—test on actual LWR site before launch. Balance speed of delivery with maintainability.
Architect Perspective
Community CSP is stricter than internal Lightning—test on actual LWR site before launch.