A way of setting the Content Security Policy header in Craft CMS

module.php

<?php
// https://jonleverrier.com/notes/weeknote-2
// - If the request is not from the control panel
// - If the request is not from the console
// - If a user is not logged in (for debug toolbar in the front-end)
if (
    !Craft::$app->request->isCpRequest && 
    !Craft::$app->request->isConsoleRequest &&
    !Craft::$app->getUser()->getIdentity()
)
{
    // Add CSP header
    Craft::$app->response->headers->add("Content-Security-Policy", "<your_policy_goes_here>");
}

Perhaps check if the request is a site request is a better cleaner condition. Not sure why you wouldn't want to set the policy on a logged in user. Just because they are logged in, doesn't mean they can be trusted and something like a CSP should apply regardless.

if (Craft::$app->getRequest()->getIsSiteRequest()) {
    Craft::$app->getResponse()->getHeaders()->add("Content-Security-Policy", "<your_policy_goes_here>");
}