title: How to configure CSP-headers with express/node.js?
body: <p>I try to get the  tags working in an express/node.js environment but somehow they always get blocked by the content security policy.</p>
  
  <p>I already tried using multiple node-modules like express-csp-header or csp-header but none of them did the trick. So I went back to 'normal' declaration.</p>
  
  <p>This is at the top of my server.ts script:</p>
  
  <pre><code>app.use((req: any, res: any, next: any) =&gt; {
      res.set({
          "Access-Control-Allow-Origin": "*",
          "Access-Control-Allow-Headers": "Origin, X-Requested-With, Content-Type, Accept",
          "Access-Control-Allow-Methods": "GET, POST, PATCH, DELETE, OPTIONS",
          "Content-Security-Policy": "default-src *",
          "X-Content-Security-Policy": "default-src *",
          "X-WebKit-CSP": "default-src *"
      })
      next();
  });
  </code></pre>
  
  <p>Which gets compiled by webpack, node is running on localhost with port 3000.</p>
  
  <p>It didn't work with just "default-src *" or similar. I even tried to declare every content type on its own, e.g.</p>
  
  <pre><code>"default-src * 'self' 'unsafe-inline' 'unsafe-eval'; script-src * 'self' 'unsafe-inline' 'unsafe-eval' localhost:*/*"
  </code></pre>
  
  <p>Here is the script part after the body tag of the html page:
  (placing it in the head section didn't change something either)</p>
  
  <pre><code>&lt;script src="scripts/loginFunctions.js"&gt;&lt;/script&gt;
  </code></pre>
  
  <p>Maybe something important:
  The HTML output gets served by squirrelly (template engine for express)</p>
  
  <pre><code>app.get('/', (req: any, res: any) =&gt; {
      res.render('login');
  })
  </code></pre>
  
  <p>Declaring the header in the head-section with meta tags also didn't work.
  The origin folder of the script on which I want to refer gets served by express:</p>
  
  <pre><code>app.use(express.static('public'));
  </code></pre>
  
  <p>Strange thing is that this didn't occure on my work environment where everything worked as expected.
  Here are my error messages from the browser's (Firefox 66.0.5) console:</p>
  
  <pre><code>Loading failed for the &lt;script&gt; with source “http://localhost:3000/scripts/loginFunctions.js”.
  Content Security Policy: The page's settings blocked the loading of a resource at http://localhost:3000/scripts/loginFunctions.js ("script-src").
  Content Security Policy: The page's settings blocked the loading of a resource at inline ("script-src").
  </code></pre>
  
  <p>And yes I'm aware about the risks but this will be running local all the time and even if it will deploy some day... I just want everything running smooth (or run at all) during development.
  Any help on how to fix this will be appreciated :)</p>