Hi,
We’re embedding the Zoom Contact Center Campaign chat widget (via zcc-sdk.js) on a Salesforce Experience Cloud site. Due to Salesforce’s Content Security Policy restrictions - specifically, the script-src directive is not configurable through the Salesforce admin UI - we cannot load the Zoom SDK script directly inside a Lightning Web Component without getting CSP errors in the browser. I think this is because of the type=module part of the tag ,which dynamically imports resources and without script-src, Salesforce doesn’t allow this.
The only viable workaround I’ve found is to load the SDK inside a Visualforce page and embed that page in an iframe within the LWC. It works, but it creates a sizing problem. The iframe must be large enough to display the chat widget, but a full-page iframe (width: 100%; height: 100%) with position: fixed overlays the entire site and blocks all user interaction with the page beneath it. Using pointer-events: none obviously won’t work either as it makes the rendered chat icon not clickable. The chat bubble and chat window only occupy a small portion of the screen, but the invisible iframe intercepts all clicks and scrolls across the full viewport.
Our current solution uses a MutationObserver inside the Visualforce page to detect when the SDK renders or removes its UI elements (bubble vs chat window). When the state changes, we send the required iframe dimensions to the parent LWC via postMessage, and the LWC dynamically resizes the iframe to tightly fit the widget. This works, but it relies on observing SDK-internal CSS class names (e.g. .livesdk__Draggable) which could change without notice in a future SDK update.
It works, but it feels like we’re fighting it and that its a bit hacky. Does anyone know if this is the only approach we can take for embedding the Zoom Contact Center chat widget in a CSP-restricted environment like Salesforce Experience Cloud, or is there an official integration method or SDK configuration option that handles iframe embedding and sizing natively?
I hope someone can help.
Thanks,
Ben