Content Security Policy default Setup of Primefaces restricts Bootsfaces scripts

Question

I've a project using Primefaces & Bootsfases, when I enabled, I encountered many issues in Ajax calls

<context-param>
    <param-name>primefaces.CSP</param-name>
    <param-value>true</param-value>
</context-param>

I've tried to customize the policy as described here https://primefaces.github.io/primefaces/8_0/#/core/contentsecuritypolicy?id=content-security-policy

<context-param>
    <param-name>primefaces.CSP_POLICY</param-name>
    <param-value>script-src 'self' https:***cdn of blocked scripts*** </param-value>
</context-param>

But no effect, appreciate if anyone has any clue.