Lightning components, CometD - Refused to connect to ... because it violates the following Content Security Policy directive

The error you are reporting is related to the fact that the Salesforce Platform does not yet provide a WebSocket server for Platform Events.

While waiting for this feature, you have to add this line just after your call to cometd.configure(...) :

cometd.websocketEnabled = false;

This will switch CometD to a long polling transport.

You can check out a working example of a Lightning Component that registers to a Platform Event in the Build an Instant Notification App Trailhead project.

Cheers,

The Lightning Component framework uses Content Security Policy (CSP), which is a W3C standard, to control the source of content that can be loaded on a page. To use third-party APIs that make requests to an external (non-Salesforce) server, add the server as a CSP Trusted Site.

When you define a CSP Trusted Site, the site’s URL is added to the list of allowed sites for the following directives in the CSP header.

• connect-src
• frame-src
• img-src
• style-src
• font-src
• media-src

Create CSP Trusted Sites to Access Third-Party APIs