We have some javascript libraries and other static content that are used by many different apps on different servers. We want to deploy one location where they can be loaded from by the pages.

Naturally, this means we get blocked-CSP (Content Security Policy). The server name is replace by static-server below. Note that the content is on port 9081 in dev, but I've tried with and without that port specifier in each of the below. I have tried adding the target server to a meta tag:

meta http-equiv="Content-Security-Policy"
  content="default-src 'self'; img-src http://static-server*; child-src 'none';"

I tried adding it to the Content-Security-Policy HTTP header that we already have

default-src 'self' 'unsafe-inline' 'unsafe-eval'  https://www.google.com https://www.gstatic.com https://fonts.gstatic.com https://fonts.googleapis.com http://dev-afmsinet-12;img-src 'self' data:   https://www.google.com https://www.gstatic.com https://fonts.gstatic.com https://fonts.googleapis.com http://dev-afmsinet-12;font-src 'self' data:  https://www.google.com https://www.gstatic.com https://fonts.gstatic.com https://fonts.googleapis.com http://static-server;

I also tried adding a Access-Control-Allow-Origin HTTP header.

http://static-server*

How can I get this to work? We just don't want to be deploying these same libraries over and over with each app.