Content Security Policy issue node js react

I did two strategies and none of the resolved my problem: 1- meta data by pass :

<meta http-equiv="Content-Security-Policy" content="...">

Content Security Policy can be delivered in 2 ways: HTTP header and <meta>. You have one restrictive CSP via HTTP header and have add the second via <meta>. 2 CSP work as 2 consequented filters, only soures passed through both will allowed. Therefore the <meta> do allow nothing additional to the header's CSP. Instead of <meta> you need to add sources to the first CSP, something like that:

app.use(
  helmet({
    contentSecurityPolicy: {
      directives: {
        defaultSrc: ["'self'"], 
        scriptSrc: ["'self'", "'unsafe-inline'",  'https://ajax.googleapis.com', 'https://stackpath.bootstrapcdn.com'],
        styleSrc: ["'self'"],
        imgSrc: ["*", 'data:'],
        connectSrc: ["'self'"],
        frameSrc: ["'self'"],
      },
    }
  })
);

this workaround will help to solve second error message.

2- In my node js I used helmet module as the below :

app.use(helmet({
  contentSecurityPolicy: false,
}));

This totally switch Off the CSP header, so it helps to avoid Refused to load the script 'https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js' ... error.

But the first error Refused to connect to 'localhost:3000/visitor' because it violates the following Content Security Policy directive: "default-src 'self'" still remain.
This happens because you do not have a route on the server for localhost:3000/visitor URL, therefore you get 404 Not found error.

NodeJS finalhandler serving the error pages, has it's own CSP default-src 'self' for safety so you observe error in CSP not you manage.
Make correct static route for /visitor URL and this error disappears.