Content-Security-Policy refusing to load localhost script

Question

I'm building a micro-frontend web app with single-spa and am trying to set up import map overrides on my deployed site.

I'm getting the following console error when trying to load a micro frontend script from localhost

script-load.js:86 Refused to load the script 'http://localhost:8085/whatever.js' because it violates the following Content Security Policy directive: "script-src 'unsafe-inline' 'unsafe-eval' https: localhost:*". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

I have the following Content-Security-Policy in my HTML:

meta http-equiv="Content-Security-Policy" content="default-src 'self' https: localhost:*; script-src 'unsafe-inline' 'unsafe-eval' https: localhost:*; connect-src https: localhost:* ws://localhost:*; style-src 'unsafe-inline' https:; object-src 'none';"

I was under the impression that script-src localhost:* would allow overriding the MFE scripts with scripts I had running locally.

Answer 1

Keep the import map like this don't add http before

 <script type="systemjs-importmap">
    {
      "imports": {
        "@dell/react1":"//localhost:8080/test-react1.js"
      }
    }
  </script>