Configure CSP in appsettings.json but want to set OnSendingHeader

[litera]

I would like to configure CSP in the appsettings.json but as the title suggests also prevent adding the header for some requests that don't make sense (similar to how it's described in the docs to omit the response header on API requests).

I set the configuration using

services.Configure<CspOptions>(configuration.GetSection("Csp"));

and in order to configure OnSendingHeader in the UseCsp:

app.UseCsp(cspBuilder =>
{
    cspBuilder.OnSendingHeader = ctx =>
    {
        ctx.ShouldNotSend = /* boolean condition */
        return Task.Completed;
    }
});

which overrides the CSP options defined in the appsettings.json which IMO is a bug. If the options are already configured, the UseCsp call with the builder parameter should not generate empty CSP which it does.

[litera]

Mitigation until this is resolved

Assuming CSP options are singleton

app.UseCsp();
var options = app.ApplicationServices.GetRequiredService<IOptions<CspOptions>>();
options.Value.OnSendingHeader = context =>
{
    context.ShouldNotSend = context.HttpContext.Request.Path.StartWithSegment("/api");
    return Task.CompletedTask;
}