Firefox NodeJS Content Security Policy (“default-src”) Error

Question

Just upgraded to latest FF, and ALL of my backend dev is now broken.

Code example:

server.js

'use strict'
// dependencies
const bodyParser = require('body-parser')
const cors = require('cors')
const express = require('express')


// local definitions
const port = process.env.PORT || 4201
const bugsAPI = require('./bugs.api.js')

const app = express()

// Middleware
app.use(cors())
app.options('*',cors())
var allowCrossDomain = function(req,res,next) {
    res.header('Access-Control-Allow-Origin', '*')
    res.header('Access-Control-Allow-Methods', 'GET, PUT, POST, DELETE')
    res.header('Access-Control-Allow-Headers', 'Content-Type')
    next();
}
app.use(allowCrossDomain)
app.use(bodyParser.json())
app.use('/api/bugs', bugsAPI)


app.listen(port, () => console.log(`Server started on port ${port}`))

bugs.api.js

const router = require('express').Router()
const mongodb = require('mongodb')

const config = require('./mongo.config.json')

// load current bugList on first request
router.get('/', async (req, res) => {
  const bugList = await loadBugsCollection()
  res.send(await bugList.find({}).toArray())
})

// Get list of bugs
async function loadBugsCollection() {
  const client = await mongodb.MongoClient.connect(
    config.mongo_hook,
    {
      useNewUrlParser: true,
      useUnifiedTopology: true
    }
  )

  return client.db(config.db).collection('tickets')
}

module.exports = router

the following solutions have NOT worked:

Loading of a resource blocked by Content Security Policy

How to fix 'Content Security Policy: The page’s settings blocked the loading of a resource at http://localhost:8080/favicon.ico (“default-src”).'

https://lollyrock.com/posts/content-security-policy/

Helmet CSP not working correctly?

How to configure CSP-headers with express/node.js?

https://github.com/nextcloud/server/issues/12724

how to correct issue with nodejs with react app not loading content properly related to Content Security Policy

Call to function() blocked by CSP even after adding 'unsafe-eval'

https://github.com/helmetjs/helmet

Make Angular working with restrictive Content Security Policy (CSP)

Content security policy blocking remote CSS background image

Content Security Policy "data" not working for base64 Images in Chrome 28

It all worked last week. Super frustrated with this breaking change; please help!!