title: Content-Security-Policy: Refused to execute inline script on lite server
body: <p>I am following angular's best practice in order to make PWA. After making production build (<code>ng built --prod --aot</code>). I am also running from dist on <code>localhost</code>: <code>npm run dev</code> (<code>"dev": "lite-server"</code>).
  When the browser load I get an error in the console:</p>
  
  <p><code>Refused to execute inline script because it violates the following Content Security Policy directive: "default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-EzX1NiGgmo59Hi8wZ/thoAxnVbkTfzIAgnVddwzUO3Y='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'script-src' was not explicitly set, so 'default-src' is used as a fallback.</code></p>
  
  <p>I tried to add to index.html:
  <code>&lt;meta http-equiv="Content-Security-Policy" content="default-src 'self' 'unsafe-eval' 'unsafe-inline';"&gt;</code></p>
  
  <p>What am I doing wrong?</p>