title: content-security-policy meta tag for allowing web socket
body: <p>Situation: autoreload of <code>phonegap serve</code> blocked by content-security-policy meta tag</p>
  
  <p>Adding content security policy prevents auto-reload of <code>phonegap serve</code> utility. This is built on top of <code>cordova serve</code> but auto-reloads the app on file editing. It works by injecting <code>socket.io</code> in <code>index.html</code>. What should I specify in my CSP meta tag that will allow socket connections to my laptop. </p>
  
  <p>Here is my current CSP meta tag:</p>
  
  <pre><code>&lt;meta http-equiv="Content-Security-Policy" content="default-src 'self' 192.168.0.100 * ws:* ; connect-src ws://192.168.0.100 ws:*"&gt; 
  </code></pre>
  
  <p>However on opening, the device keeps showing "Connecting to device" and not event is received on the device.</p>
  
  <p>Also note that it starts working on removing this meta tag which mean the <code>cordova-plugin-whitelist</code> might not be blocking it.</p>