How to address content security policy directive for React in production

Question

I am building a React app with create-react-app which I serve the static build from a node/express server which also acts as my API gateway.

On the React