I have a websocket application running and Apache configured to serve it via reverse proxy. Here is the apache config

<VirtualHost *:80>
    ServerName 192.168.2.121

    # Proxy for WebSocket
    ProxyPass /ssh/websocket ws://192.168.2.121:8086/ssh/websocket
    ProxyPassReverse /ssh/websocket ws://192.168.2.121:8086/ssh/websocket

    
    # Content Security Policy
    Header always set Content-Security-Policy "default-src 'self'; connect-src 'self' ws://192.168.2.121:8086; script-src 'self';"
    # ErrorLog and CustomLog
    ErrorLog /var/opt/oe/base/log/gui/websocketapp_error.log
    CustomLog /var/opt/oe/base/log/gui/websocketapp_access.log combined

    <Directory /opt/oe/toposrv/sbin/ >
        Require all granted
    </Directory>
    <Directory /var/opt/oe/base/log/gui >
        Require all granted
    </Directory>
</VirtualHost>

When I try to send a connection request for the websocket I get the following error

Refused to connect to 'ws://192.168.2.121:8086/ssh/websocket?username=&password=&node_name=edge1-site1' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback.

Is there something wrong with the config?