CSP issue on downloading through the browser in FireFox

[steve-schmidt-dw]

I am working on a plugin to download files off of our main server running cockpit. I have used the code on other websites outside of Cockpit with success.

My current csp is set in the manifest.json.

"content-security-policy": "default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: gap: content: https://34.135.11.84:9090; base-uri 'self'; script-src 'self' 'self' 'unsafe-inline' 'unsafe-eval'; connect-src 'self'  'unsafe-inline' 'unsafe-eval'; font-src 'self' 'unsafe-inline' 'unsafe-eval'; form-action 'self' 'unsafe-inline' 'unsafe-eval'; frame-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'self' blob: data: 'unsafe-eval'; style-src 'self' 'unsafe-inline' 'unsafe-eval';

My download code is

downloadFile(filename, data) {
    return new Promise(function(resolve, reject) {
      try {
        console.log(data);
        let element = document.createElement('a');
        element.setAttribute('href', 'data:text/plain;charset=utf-8,' + encodeURIComponent(data));
        element.setAttribute('download', filename);
        element.style.display = 'none';
        document.body.appendChild(element);
        element.click();
        document.body.removeChild(element);
        resolve(true);
      } catch (error) {
        reject(error);
      }
    })
  };

I get the file downloaded in Chrome but get this in FireFox

Content Security Policy: The page’s settings blocked the loading of a resource at blob:https://[ip]:9090/b61ec578-996d-490b-8d1e-04cc3d007ec3 (“default-src”).

It looks like the cockpit policy page is being overwritten when I open my app and check the network tab in dev-tools, I see this on the response.

Content-Security-Policy
	default-src 'self' https://34.135.11.84:9090; connect-src 'self' https://34.135.11.84:9090 wss://34.135.11.84:9090; form-action 'self' https://34.135.11.84:9090; base-uri 'self' https://34.135.11.84:9090; object-src 'none'; font-src 'self' https://34.135.11.84:9090 data:; img-src 'self' https://34.135.11.84:9090 data:; block-all-mixed-content

Am I missing something or is this not available in Cockpit plugins.