I'm writing a Craft CMS plugin with a widget. This widget needs to make calls to the Github-API trough javascript (Selectize is used in the widget). Now, the problem is that it's not allowed, made clear by this message in the console:

Refused to connect to 'https://api.github.com/search/repositories/?q=i' because it violates the following Content Security Policy directive: "default-src 'self' data:". Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback.

I can fix this by setting the Content-Security-Policy meta tag in the head:

<meta http-equiv="Content-Security-Policy" content="script-src 'self' https://api.github.com/">

I've attempted to add this with the following code in the template for my widget:

{% set meta %}
    <meta http-equiv="Content-Security-Policy" content="script-src 'self' https://api.github.com/">
{% endset %}
{% includeHeadHtml(meta) %}

Is this correct or is there a better way?

1 Answer 1


It looks as if there is a Content-Security-Policy header that may also do what you want. You should be able to use the header tag to set this:

{% header "script-src: 'self' https://api.github.com/;" %}
  • Thanks for your answer, but this doesn't seem the work. first there's the internal server error "Unexpected character ";".", removing the ; and adding a " to the end resolves in a new error: Unexpected token "name" of value "script" ("end of statement block" expected). So kinda stuck here again :) Commented Aug 21, 2016 at 14:49
  • @IbeVanmeenen there was a typo in the original answer. give it a whirl again.
    – Brad Bell
    Commented Aug 22, 2016 at 17:26
  • @MarionNewlevant Errors are gone now, but the issue is still there... The call is made by the Selectize.js plugin (selectize.github.io/selectize.js). So I'm not making al call trough php, but trough Javascript... Commented Aug 23, 2016 at 19:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.