contentSecurityPolicy blocking cdn

when I am using app.use(helmet()) its blocking all other cdn & static urls but if I use the code below then cdn & static urls working fine.

app.use(
  helmet({
    contentSecurityPolicy: false,
  })
)

[EvanHahn]

I’m not sure, but I wouldn’t. If someone serves malicious code on www.google.evil.com, for example, you’d be vulnerable.

[krishnaTORQUE]

alright so my final code is below which solved the svg issue too.

app.use(
  helmet({
    contentSecurityPolicy: {
      directives: {
        defaultSrc: [
          "'self'",
          "'unsafe-inline'",
          'data:',
          'localhost',
          'main-domain.com',
          '*.main-domain.com',
          '*.google.com',
          '*.google.co.in',
          '*.google-analytics.com',
          '*.googlesyndication.com',
          '*.googleadservices.com',
          '*.googletagservices.com',
          '*.googleapis.com',
          '*.doubleclick.net',
          '*.gstatic.com',
          'youtu.be',
          '*.youtu.be',
          '*.youtube.com',
        ],
      },
    },
  })
)

the only issue i am facing is in production. api send all request 404 example api path '/api/user’

another issue I have added google.com & google.co.in but is there any way use .google. I found it is not working