Should i set content security policy headers in ajax responses too in single page app?

Question

I have single page app in which i only load index and every other request is ajax request.

Do i need to use CSP headers in those ajax responses or CSP is already enforced for everything after loading index ? So basically the only place i need to set content security policy headers is index?

Answer 1

So basically the only place i need to set content security policy headers is index?

Correct. CSP is applied to the document and is not affected by AJAX requests.