Bug report: Possible Null Ref

[jamie-taylor-rjj]

The Bug

It is entrely possible to cause a null refernece exception if a user bypasses the configuration builder and manually sets the relevant Use{HeaderName} bool to true without also setting the value of the relevant POCO. see "Minimal Code Sample" for details

Software Versions Used

• OwaspHeaders.Core version number: all versions
• .NET SDK used: .NET 10
• IDE used: Rider (not relevant)

Minimal Code Sample

The following is a minimal code sample which helps to highlight my question.

// note that we're only explicitly including the Hsts header here
var customConfig = SecureHeadersMiddlewareBuilder
    .CreateBuilder()
    .UseReferrerPolicy()
    .Build();

// explicitly set a bool for a header we haven't configured
customConfig.UseCacheControl = true;

app.UseSecureHeadersMiddleware(customConfig);

Whenever the header collection is generated (i.e. for the first request), we will get an unhandled null reference exception, leading the application to crash.

[jamie-taylor-rjj]

I'll add a validate method for now, but we should come back in the next version and lock this down. I suggest that we add internal to the setters for each of the bools. That way we can't set their value from anywhere other than witihn the configuration object.