I’m learning to use express / node.js for web development. I have a simple index.js file set up. I can access http://localhost:3001/ fine. But when I try to access http://localhost:3001/api/people (defined as inline scripts) I get the following error:

Content-Security-Policy: The page’s settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: “default-src ‘none’ (prepareInjection.js:1:1063)” error.

This is despite me having used dozens of variations of the helmet declaration

app.use(csp({
 directives: {
  defaultSrc: ["'self'"],
  styleSrc: ["'self'", 'maxcdn.bootstrapcdn.com']
 }
}))`

to override the default CSP defaultSrc. What’s going on? I was working on another script earlier that was just fine but this one is impossible to debug. My header looks like:

const http = require('http');
const express = require('express');
const csp = require('helmet-csp')
const app = express();

app.use(csp({
   directives: {
   defaultSrc: ["'self'"],
   styleSrc: ["'self'", 'maxcdn.bootstrapcdn.com']
 }
}))

 // ... //

Thanks in advance!

Tried to use helmet to override CSP error. Did not work.