How to set a meta-tag from a plugin I'm writing a Craft CMS plugin with a widget. This widget needs to make calls to the Github-API trough javascript (Selectize is used in the widget). Now, the problem is that it's not allowed, made clear by this message in the console:


  Refused to connect to 'https://api.github.com/search/repositories/?q=i' because it violates the following Content Security Policy directive: "default-src 'self' data:". Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback.


I can fix this by setting the Content-Security-Policy meta tag in the head:

&lt;meta http-equiv="Content-Security-Policy" content="script-src 'self' https://api.github.com/"&gt;


I've attempted to add this with the following code in the template for my widget:

{% set meta %}
    &lt;meta http-equiv="Content-Security-Policy" content="script-src 'self' https://api.github.com/"&gt;
{% endset %}
{% includeHeadHtml(meta) %}


Is this correct or is there a better way?
It looks as if there is a Content-Security-Policy header that may also do what you want. You should be able to use the header tag to set this:

{% header "script-src: 'self' https://api.github.com/;" %}