Add SecureHeaders pipe to default web pipeline

Co-authored-by: renich <225115+renich@users.noreply.github.com>

Author: google-labs-jules[bot]

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2024-05-24 - [Missing Default Security Headers]
+**Vulnerability:** Newly generated Amber framework apps omit foundational HTTP security headers (e.g., XSS Protection, Content-Type Options).
+**Learning:** The pipeline configuration in `routes.cr.ecr` lacked a dedicated middleware pipe to enforce baseline security headers for web routes.
+**Prevention:** Always include a SecureHeaders middleware in the default web pipeline to ensure a defense-in-depth posture out of the box.

spec/amber/pipes/secure_headers_spec.cr

@@ -0,0 +1,21 @@
+require "../../spec_helper"
+
+module Amber::Pipe
+  describe SecureHeaders do
+    it "adds security headers to the response" do
+      request = HTTP::Request.new("GET", "/")
+      response = HTTP::Server::Response.new(IO::Memory.new)
+      context = HTTP::Server::Context.new(request, response)
+
+      pipe = SecureHeaders.new
+      pipe.next = HTTP::Handler::HandlerProc.new { |ctx| }
+
+      pipe.call(context)
+
+      context.response.headers["X-Content-Type-Options"].should eq "nosniff"
+      context.response.headers["X-XSS-Protection"].should eq "1; mode=block"
+      context.response.headers["X-Frame-Options"].should eq "SAMEORIGIN"
+      context.response.headers["Strict-Transport-Security"].should eq "max-age=31536000; includeSubDomains"
+    end
+  end
+end

src/amber/cli/templates/app/config/routes.cr.ecr

@@ -10,6 +10,7 @@ Amber::Server.configure do
     plug Amber::Pipe::Session.new
     plug Amber::Pipe::Flash.new
     plug Amber::Pipe::CSRF.new
+    plug Amber::Pipe::SecureHeaders.new
   end
 
   pipeline :api do

src/amber/pipes/secure_headers.cr

@@ -0,0 +1,26 @@
+module Amber
+  module Pipe
+    # The SecureHeaders pipe sets security-related HTTP headers to help
+    # protect against common vulnerabilities like XSS, clickjacking, and MIME sniffing.
+    class SecureHeaders < Base
+      def call(context : HTTP::Server::Context)
+        headers = context.response.headers
+
+        # Prevent browser from guessing the MIME type
+        headers["X-Content-Type-Options"] ||= "nosniff"
+
+        # Enable XSS filtering in browsers
+        headers["X-XSS-Protection"] ||= "1; mode=block"
+
+        # Prevent clickjacking by not allowing the page to be framed
+        headers["X-Frame-Options"] ||= "SAMEORIGIN"
+
+        # Enforce HTTPS connections (if using HTTPS)
+        # Note: In a real production app, you might want to configure max-age or includeSubDomains
+        headers["Strict-Transport-Security"] ||= "max-age=31536000; includeSubDomains"
+
+        call_next(context)
+      end
+    end
+  end
+end