OSM does not work in HTTPS (header CSP)

Here is the error message in the console :

because it violates the following Content Security Policy directive: "default-src https: data: 'unsafe-inline' 'unsafe-eval'". Note that 'img-src' was not explicitly set, so 'default-src' is used as a fallback.

Here is the configuration of my server :

    Header always set Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Download-Options "noopen"
    Header always set X-Permitted-Cross-Domain-Policies "none"
    Header always set Content-Security-Policy "default-src https: data: 'unsafe-inline' 'unsafe-eval'"
    Header set Set-Cookie HttpOnly;Secure

I found this :

https://github.com/Leaflet/Leaflet/issues/3186