From bb0a0f749b86713da38fc494dc3858b7fef73240 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A9nich=20Bon=20=C4=86iri=C4=87?= Date: Mon, 15 Jun 2026 04:51:38 -0600 Subject: [PATCH 1/2] security: register SecureHeaders pipe in routes template MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Registers Amber::Pipe::SecureHeaders.new in the generated web pipeline before Amber::Pipe::Error. Placing SecureHeaders before Error ensures that unrouted (404) and error responses retain baseline security headers (such as X-Content-Type-Options: nosniff). Co-developed-by: Gemini AI Signed-off-by: Rénich Bon Ćirić --- src/amber_cli/templates/app/config/routes.cr.ecr | 1 + 1 file changed, 1 insertion(+) diff --git a/src/amber_cli/templates/app/config/routes.cr.ecr b/src/amber_cli/templates/app/config/routes.cr.ecr index c3343f8..eeab13b 100644 --- a/src/amber_cli/templates/app/config/routes.cr.ecr +++ b/src/amber_cli/templates/app/config/routes.cr.ecr @@ -1,5 +1,6 @@ Amber::Server.configure do pipeline :web do + plug Amber::Pipe::SecureHeaders.new plug Amber::Pipe::Error.new plug Amber::Pipe::Logger.new plug Amber::Pipe::Session.new From 487a1e1d01a2d13e29b6042dae7a1db9e667d55c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A9nich=20Bon=20=C4=86iri=C4=87?= Date: Wed, 16 Sep 2026 01:47:06 -0600 Subject: [PATCH 2/2] security(routes): plug SecureHeaders across web, static, and api pipelines MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Plug Amber::Pipe::SecureHeaders before Error pipe in active NewCommand generator heredoc as well as legacy routes.cr.ecr template. Include regression spec asserting presence in generated routes. Co-developed-by: Gemini AI Signed-off-by: Rénich Bon Ćirić --- spec/commands/new_command_spec.cr | 1 + src/amber_cli/commands/new.cr | 3 +++ src/amber_cli/templates/app/config/routes.cr.ecr | 1 + 3 files changed, 5 insertions(+) diff --git a/spec/commands/new_command_spec.cr b/spec/commands/new_command_spec.cr index d68c6ae..9939c0e 100644 --- a/spec/commands/new_command_spec.cr +++ b/spec/commands/new_command_spec.cr @@ -114,6 +114,7 @@ describe AmberCLI::Commands::NewCommand do config["database"]["url"].as_s.should contain("sqlite3:") routes = File.read(File.join(destination, "config/routes.cr")) + routes.should contain("Amber::Pipe::SecureHeaders.new") routes.should contain("pipeline :static") routes.should contain("Amber::Pipe::Static.new") routes.should contain(%(get "/*", Amber::Controller::Static, :index)) diff --git a/src/amber_cli/commands/new.cr b/src/amber_cli/commands/new.cr index 0876509..7d754d8 100644 --- a/src/amber_cli/commands/new.cr +++ b/src/amber_cli/commands/new.cr @@ -457,6 +457,7 @@ CONTROLLER routes_content = <<-ROUTES Amber::Server.configure do pipeline :web do + plug Amber::Pipe::SecureHeaders.new plug Amber::Pipe::Error.new plug Amber::Pipe::Logger.new plug Amber::Pipe::Session.new @@ -465,11 +466,13 @@ Amber::Server.configure do end pipeline :static do + plug Amber::Pipe::SecureHeaders.new plug Amber::Pipe::Error.new plug Amber::Pipe::Static.new("./public") end pipeline :api do + plug Amber::Pipe::SecureHeaders.new plug Amber::Pipe::Error.new plug Amber::Pipe::Logger.new end diff --git a/src/amber_cli/templates/app/config/routes.cr.ecr b/src/amber_cli/templates/app/config/routes.cr.ecr index eeab13b..c16fb6f 100644 --- a/src/amber_cli/templates/app/config/routes.cr.ecr +++ b/src/amber_cli/templates/app/config/routes.cr.ecr @@ -9,6 +9,7 @@ Amber::Server.configure do end pipeline :static do + plug Amber::Pipe::SecureHeaders.new plug Amber::Pipe::Error.new plug Amber::Pipe::Static.new("./public") end