SecHdrsCore 1.0.11

Build up Security Headers in a (semi) modular way.
To use in an ASP.Net Core web project.
In startup.cs - add the following private members to the startup class
       private SecurityHeaders _securityHeaders { get; set; }
       private List<CspFrame> _cspFrames { get; set; }

And the following two private methods (and alter as you need to).  These do reference the samples nuget package.
       private List<CspFrame> AssembleContentSecurityPolicies()
       {
           var defCspFrame = new CspFrame().Initialise("default");
           defCspFrame.Clauses
               .AddUpdateClause("script-src", "", "'unsafe-eval'")
               .AddUpdateClause("style-src", "", "'unsafe-inline'")
               .AddUpdateClause("img-src", "", "data:")
               .AddUpdateClause("plugin-types", "", "application/pdf")
               .AddUpdateClause("frame-ancestors", "", "'none'")
               .AddUpdateClause("report-uri", "", "/cspreport");

           var basicCdnCspFrame = new CspFrame().Initialise("basicCdn");
           basicCdnCspFrame.Clauses
               .AddUpdateClause("default-src", "", "https://maxcdn.bootstrapcdn.com/")
               .AddUpdateClause("script-src", "", "https://ajax.googleapis.com/ https://code.jquery.com/ https://cdnjs.cloudflare.com/")
               .AddUpdateClause("style-src", "", "https://fonts.googleapis.com/")
               .AddUpdateClause("font-src", "", "https://fonts.gstatic.com/")
               .AddUpdateClause("img-src", "", "https://csi.gstatic.com/");

           var googleMapsCspFrame = new CspFrame().GoogleMaps();
           var stripeCspFrame = new CspFrame().Stripe();

           return new List<CspFrame>
           {
               defCspFrame,
               basicCdnCspFrame,
               googleMapsCspFrame,
               stripeCspFrame
           };
       }

       /// <summary>
       /// Returns a merged copy of all relevant CspFrames - adding in the Dev CspFrame if required
       /// </summary>
       /// <param name="env"></param>
       /// <returns></returns>
       private CspFrame BuildContentSecurityPolicy(IHostingEnvironment env)
       {
           if (_cspFrames == null || !_cspFrames.Any())
           {
               _cspFrames = AssembleContentSecurityPolicies();
           }

           // Assemble the master CSP
           var masterCsp = _cspFrames.Merge();

           if (env.IsDevelopment())
           {
               var localhostSp = "localhost:56993/";
               var stripe = "http://checkout.stripe.com/";

               // Note that this dev CSP includes the http versions for Stripe
               var devCspFrame = new CspFrame().Initialise("dev");
               devCspFrame.Clauses.AddUpdateClause("default-src", "", "http://localhost:5000/")
                   .AddUpdateClause("connect-src", "", "http://" + localhostSp + " ws://" + localhostSp + " " + stripe)
                   .AddUpdateClause("script-src", "", "http://" + localhostSp + " " + stripe);

               masterCsp = masterCsp.Merge(devCspFrame);
           }

           return masterCsp;
       }

Finally include the following in the configuration method just before app.UseMvc( ...
           // Set up the overall Security Headers
           // This will also assemble the _cspFrames object if required
           if (_securityHeaders == null)
           {
               _securityHeaders = app.BuildSecurityHeaders(BuildContentSecurityPolicy(env));
           }
           else
           {
               _securityHeaders.Csp = BuildContentSecurityPolicy(env);
           }
           app.UseSecurityHeaders(_securityHeaders);