Answers.Body: <p>It looks as if there is a <a href="https://content-security-policy.com/" rel="nofollow">Content-Security-Policy</a> header that may also do what you want. You should be able to use the <a href="https://craftcms.com/docs/templating/header" rel="nofollow">header</a> tag to set this:</p>
  
  <pre><code>{% header "script-src: 'self' https://api.github.com/;" %}
  </code></pre>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-08-21T14:49:54.233Z
Answers.Text: Thanks for your answer, but this doesn't seem the work. first there's the internal server error "Unexpected character ";".", removing the ; and adding a " to the end resolves in a new error: Unexpected token "name" of value "script" ("end of statement block" expected). So kinda stuck here again :)
Answers.UserDisplayName: Ibe Vanmeenen
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-08-22T17:26:58.990Z
Answers.Text: @IbeVanmeenen there was a typo in the original answer. give it a whirl again.
Answers.UserDisplayName: Brad Bell
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-08-23T19:03:22.823Z
Answers.Text: @MarionNewlevant Errors are gone now, but the issue is still there... The call is made by the Selectize.js plugin (http://selectize.github.io/selectize.js/). So I'm not making al call trough php, but trough Javascript...
Answers.UserDisplayName: Ibe Vanmeenen
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-08-20T20:52:49.613Z
Answers.LastActivityDate: 2016-08-22T17:26:29.920Z
Answers.LastEditDate: 2016-08-22T17:26:29.920Z
Answers.UserDisplayName: Marion Newlevant
Body: <p>I'm writing a Craft CMS plugin with a widget. This widget needs to make calls to the Github-API trough javascript (<a href="http://selectize.github.io/selectize.js/" rel="nofollow">Selectize</a> is used in the widget). Now, the problem is that it's not allowed, made clear by this message in the console:</p>
  
  <blockquote>
    <p>Refused to connect to '<a href="https://api.github.com/search/repositories/?q=i" rel="nofollow">https://api.github.com/search/repositories/?q=i</a>' because it violates the following Content Security Policy directive: "default-src 'self' data:". Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback.</p>
  </blockquote>
  
  <p>I can fix this by setting the Content-Security-Policy meta tag in the head:</p>
  
  <pre><code>&lt;meta http-equiv="Content-Security-Policy" content="script-src 'self' https://api.github.com/"&gt;
  </code></pre>
  
  <p>I've attempted to add this with the following code in the template for my widget:</p>
  
  <pre><code>{% set meta %}
      &lt;meta http-equiv="Content-Security-Policy" content="script-src 'self' https://api.github.com/"&gt;
  {% endset %}
  {% includeHeadHtml(meta) %}
  </code></pre>
  
  <p>Is this correct or is there a better way?</p>
  
Tags: <plugin-development><templating><plugins>
Title: How to set a meta-tag from a plugin
ThreadText: # How to set a meta-tag from a plugin
  
  (Asked by: username_0 on 2016-08-20)
  
  I'm writing a Craft CMS plugin with a widget. This widget needs to make calls to the Github-API trough javascript ([Selectize](http://selectize.github.io/selectize.js/) is used in the widget). Now, the problem is that it's not allowed, made clear by this message in the console:
  
  > Refused to connect to '<https://api.github.com/search/repositories/?q=i>' because it violates the following Content Security Policy directive: "default-src 'self' data:". Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback.
  
  I can fix this by setting the Content-Security-Policy meta tag in the head:
  
  ```
  <meta http-equiv="Content-Security-Policy" content="script-src 'self' https://api.github.com/">
  
  ```
  
  I've attempted to add this with the following code in the template for my widget:
  
  ```
  {% set meta %}
      <meta http-equiv="Content-Security-Policy" content="script-src 'self' https://api.github.com/">
  {% endset %}
  {% includeHeadHtml(meta) %}
  
  ```
  
  Is this correct or is there a better way?
  
  **Tags:** plugin-development, templating, plugins
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2016-08-20. Score: 3
  
  It looks as if there is a [Content-Security-Policy](https://content-security-policy.com/) header that may also do what you want. You should be able to use the [header](https://craftcms.com/docs/templating/header) tag to set this:
  
  ```
  {% header "script-src: 'self' https://api.github.com/;" %}
  
  ```
  
  > **Comments:**
  > **username_0**: Thanks for your answer, but this doesn't seem the work. first there's the internal server error "Unexpected character ";".", removing the ; and adding a " to the end resolves in a new error: Unexpected token "name" of value "script" ("end of statement block" expected). So kinda stuck here again :)  
  > **username_2**: @username_0 there was a typo in the original answer. give it a whirl again.  
  > **username_0**: @username_1 Errors are gone now, but the issue is still there... The call is made by the Selectize.js plugin (http://selectize.github.io/selectize.js/). So I'm not making al call trough php, but trough Javascript...  
  
  ---
  
  