History

rui hildt 4f5db9ab26 Add initial version of dijkstra backend cloudron image		2020-10-12 11:27:15 +02:00
..
dist	Add initial version of dijkstra backend cloudron image	2020-10-12 11:27:15 +02:00
CHANGELOG.md	Add initial version of dijkstra backend cloudron image	2020-10-12 11:27:15 +02:00
LICENSE	Add initial version of dijkstra backend cloudron image	2020-10-12 11:27:15 +02:00
README.md	Add initial version of dijkstra backend cloudron image	2020-10-12 11:27:15 +02:00
package.json	Add initial version of dijkstra backend cloudron image	2020-10-12 11:27:15 +02:00

README.md

Hide X-Powered-By

Simple middleware to remove the X-Powered-By HTTP header if it's set.

Hackers can exploit known vulnerabilities in Express/Node if they see that your site is powered by Express (or whichever framework you use). For example, X-Powered-By: Express is sent in every HTTP request coming from Express, by default. This won't provide much security benefit (as discussed here), but might help a tiny bit. It will also improve performance by reducing the number of bytes sent.

const hidePoweredBy = require('hide-powered-by')
app.use(hidePoweredBy())

You can also explicitly set the header to something else, if you want. This could throw people off:

app.use(hidePoweredBy({ setTo: 'PHP 4.2.0' }))

Note: if you're using Express, you don't need this middleware and can just do this:

app.disable('x-powered-by')