How to set a meta-tag from a plugin

Question

I'm writing a Craft CMS plugin with a widget. This widget needs to make calls to the Github-API trough javascript (Selectize is used in the widget). Now, the problem is that it's not allowed, made clear by this message in the console:

Refused to connect to 'https://api.github.com/search/repositories/?q=i' because it violates the following Content Security Policy directive: "default-src 'self' data:". Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback.

I can fix this by setting the Content-Security-Policy meta tag in the head:

<meta http-equiv="Content-Security-Policy" content="script-src 'self' https://api.github.com/">

I've attempted to add this with the following code in the template for my widget:

{% set meta %}
    <meta http-equiv="Content-Security-Policy" content="script-src 'self' https://api.github.com/">
{% endset %}
{% includeHeadHtml(meta) %}

Is this correct or is there a better way?

Answer 1

It looks as if there is a Content-Security-Policy header that may also do what you want. You should be able to use the header tag to set this:

{% header "script-src: 'self' https://api.github.com/;" %}