CSP headers are more often than not: static (bar nonces). Having them be dynamic is really just a bonus to the management aspect you gain here. (You can make su

CSP headers are more often than not: static (bar nonces). Having them be dynamic is really just a bonus to the management aspect you gain here. (You can make sure every page truly only has access to load the sources it needs though). As far as using the class to do it goes, there are other benefits other than just CSP management: auto cookie upgrades and error messages about poor configuration to name a few.