<p>It looks as if there is a <a href="https://content-security-policy.com/" rel="nofollow">Content-Security-Policy</a> header that may also do what you want. You should be able to use the <a href="https://craftcms.com/docs/templating/header" rel="nofollow">header</a> tag to set this:</p>

<pre><code>{% header "script-src: 'self' https://api.github.com/;" %}
</code></pre>

CC BY-SA 3.0
2016-08-21T14:49:54.233Z
Thanks for your answer, but this doesn't seem the work. first there's the internal server error "Unexpected character ";".", removing the ; and adding a " to the end resolves in a new error: Unexpected token "name" of value "script" ("end of statement block" expected). So kinda stuck here again :)
Ibe Vanmeenen
CC BY-SA 3.0
2016-08-22T17:26:58.990Z
@IbeVanmeenen there was a typo in the original answer. give it a whirl again.
Brad Bell
CC BY-SA 3.0
2016-08-23T19:03:22.823Z
@MarionNewlevant Errors are gone now, but the issue is still there... The call is made by the Selectize.js plugin (http://selectize.github.io/selectize.js/). So I'm not making al call trough php, but trough Javascript...
Ibe Vanmeenen
CC BY-SA 3.0
2016-08-20T20:52:49.613Z
2016-08-22T17:26:29.920Z
2016-08-22T17:26:29.920Z
Marion Newlevant
<p>I'm writing a Craft CMS plugin with a widget. This widget needs to make calls to the Github-API trough javascript (<a href="http://selectize.github.io/selectize.js/" rel="nofollow">Selectize</a> is used in the widget). Now, the problem is that it's not allowed, made clear by this message in the console:</p>

<blockquote>
  <p>Refused to connect to '<a href="https://api.github.com/search/repositories/?q=i" rel="nofollow">https://api.github.com/search/repositories/?q=i</a>' because it violates the following Content Security Policy directive: "default-src 'self' data:". Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback.</p>
</blockquote>

<p>I can fix this by setting the Content-Security-Policy meta tag in the head:</p>

<pre><code>&lt;meta http-equiv="Content-Security-Policy" content="script-src 'self' https://api.github.com/"&gt;
</code></pre>

<p>I've attempted to add this with the following code in the template for my widget:</p>

<pre><code>{% set meta %}
    &lt;meta http-equiv="Content-Security-Policy" content="script-src 'self' https://api.github.com/"&gt;
{% endset %}
{% includeHeadHtml(meta) %}
</code></pre>

<p>Is this correct or is there a better way?</p>

<plugin-development><templating><plugins>
How to set a meta-tag from a plugin
# How to set a meta-tag from a plugin

(Asked by: username_0 on 2016-08-20)

I'm writing a Craft CMS plugin with a widget. This widget needs to make calls to the Github-API trough javascript (Selectize is used in the widget). Now, the problem is that it's not allowed, made clear by this message in the console:

Refused to connect to 'https://api.github.com/search/repositories/?q=i' because it violates the following Content Security Policy directive: "default-src 'self' data:". Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback.

I can fix this by setting the Content-Security-Policy meta tag in the head:


I've attempted to add this with the following code in the template for my widget:
{% set meta %}
    
{% endset %}
{% includeHeadHtml(meta) %}

Is this correct or is there a better way?

**Tags:** plugin-development, templating, plugins

---

## 1 answers

### Answer by username_1 on 2016-08-20. Score: 3

It looks as if there is a Content-Security-Policy header that may also do what you want. You should be able to use the header tag to set this:
{% header "script-src: 'self' https://api.github.com/;" %}

> **Comments:**
> **username_0**: Thanks for your answer, but this doesn't seem the work. first there's the internal server error "Unexpected character ";".", removing the ; and adding a " to the end resolves in a new error: Unexpected token "name" of value "script" ("end of statement block" expected). So kinda stuck here again :)  
> **username_2**: @IbeVanmeenen there was a typo in the original answer. give it a whirl again.  
> **username_0**: @MarionNewlevant Errors are gone now, but the issue is still there... The call is made by the Selectize.js plugin (http://selectize.github.io/selectize.js/). So I'm not making al call trough php, but trough Javascript...  

---

