I'm writing a Craft CMS plugin with a widget. This widget needs to make calls to the Github-API trough javascript (Selectize is used in the widget). Now, the problem is that it's not allowed, made clear by this message in the console:
Refused to connect to 'https://api.github.com/search/repositories/?q=i' because it violates the following Content Security Policy directive: "default-src 'self' data:". Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback.
I can fix this by setting the Content-Security-Policy meta tag in the head:
<meta http-equiv="Content-Security-Policy" content="script-src 'self' https://api.github.com/">
I've attempted to add this with the following code in the template for my widget:
{% set meta %}
<meta http-equiv="Content-Security-Policy" content="script-src 'self' https://api.github.com/">
{% endset %}
{% includeHeadHtml(meta) %}
Is this correct or is there a better way?