Yes, it allows re-use. Access-Control-Allow-Origin is in the static table, and so is Strict-Transport-Security. The rest go into the dynamic table [1], which w

Yes, it allows re-use. Access-Control-Allow-Origin is in the static table, and so is Strict-Transport-Security. The rest go into the dynamic table [1], which would be beneficial if they don't change. Most security headers are hardcodeable, while C-S-P is designed to be a function of the selected resource representation, not some site-wide global. But it's often used in such a way. [1] https://tools.ietf.org/html/rfc7541#section-2.4 https://tools.ietf.org/html/rfc7541#section-2.4