Yes of course, for all of those times when your webserver should decide the Content-Type header instead of the application serving the content. /s Seriously, t

Yes of course, for all of those times when your webserver should decide the Content-Type header instead of the application serving the content. /s Seriously, though, for headers like CSP, where the value is dependent on application logic (in this case, which domains the served document will need to access), it entirely makes sense to set the header in your application. The same applies to caching headers. Your application is the one that knows what the ETag of the document is, not your webserver.