Running your example code throws error in current Chrome stable

[franktopel]

Invalid plugin type in 'plugin-types' Content Security Policy directive: ''none''. Did you mean to set the object-src directive to 'none'

I c&p'ed your example code into a file serve.js and in my package.json I defined in "scripts":

"serve": "node serve.js"

I am using these

  "devDependencies": {
    "content-security-policy": "^0.3.4",
    "express": "^4.17.1"
  }

[erdtman]

Thanks for noticing, I´ll have a look (withing a week or so)

[erdtman]

I fail to reproduce, could you test and do a request with curl localhost:3000 -v towards your server

Is the serve.js just a copy of my example?

[franktopel]

Yes, exactly, character by character.