CSP is inherently a client-side browser security feature, so yes.