diff --git a/Framework/Backend/http/server.js b/Framework/Backend/http/server.js
index f55090bb8..b72c7b7e9 100644
--- a/Framework/Backend/http/server.js
+++ b/Framework/Backend/http/server.js
@@ -147,8 +147,9 @@ class HttpServer {
    * @param {list} config.iframeCsp list of URLs for frame-src CSP
    * @param {boolean} config.allow allow unsafe-eval in CSP
    * @param {boolean} config.allowIframeCsp allow iframe embedding from given URLs
+   * @param {list} [config.extraConnectSrc] sources appended to the default connect-src CSP
    */
-  configureHelmet({ hostname, port, iframeCsp = [], allow = false, allowIframeCsp = false }) {
+  configureHelmet({ hostname, port, iframeCsp = [], allow = false, allowIframeCsp = false, extraConnectSrc = [] }) {
     // Sets "X-Frame-Options: DENY" (doesn't allow to be in any iframe)
     this.app.use(helmet.frameguard({ action: 'deny' }));
     // Sets "Strict-Transport-Security: max-age=5184000 (60 days) (stick to HTTPS)
@@ -171,7 +172,8 @@ class HttpServer {
         ...(allowIframeCsp && { imgSrc: ["'self'", "data:", "blob:"] }),
         scriptSrc: ["'self'", ...(allow ? ["'unsafe-eval'"] : [])],
         styleSrc: ["'self'", "'unsafe-inline'"],
-        connectSrc: ["'self'", 'http://' + hostname + ':' + port, 'https://' + hostname, 'wss://' + hostname, 'ws://' + hostname + ':' + port],
+        connectSrc: ["'self'", 'http://' + hostname + ':' + port, 'https://' + hostname, 'wss://' + hostname, 'ws://' + hostname + ':' + port,
+          ...extraConnectSrc],
         upgradeInsecureRequests: null,
         frameSrc: iframeCsp
         /* eslint-enable */