Best practice for AJAX quieries

i use a separated controller for each ajax action, so ci only loads the required parts ( if your actions are gonna be more complex ). Mostly my ajax controller 1. collect data, 2. call a view for output formatting and 3. return it to the caller ( be sure to handle all possibilities, use the \CodeIgniter\API\ResponseTrait for returning with correct codes ).

to handle CSP correctly you need decide which request use user specific data to know which can be excluded from CSP check and which need to write session ( user specific ) data . so i exclude every trivial request ( check for news, updates ) and added a csp expiration check to the other - some request with write requirements also have the effect to extend the session validity.
to prevent this, you need call session_write_close() before sending the result back