Would React therefore get blocked by default by a Content Security Policy (CSP)?
A Content Security Policy (CSP) provides security controls which can mitigate attacks such as cross-site scripting (XSS) and other attacks based on introducing malicious or otherwise undesirable content into a web application. A CSP achieves this by specifying a whitelist of content sources for a web application that a compatible browser then enforces. A large variety of content can be controlled using a CSP including scripts, images and audio or video.
By default, a CSP also implements other mitigations beyond whitelisting content sources. The main additional mitigations are:
P.S. I'm totally new to React.