Turn off the X-Powered-By setting to avoid advertising Express in responses.
Security hardening
Express.js · Module
app.disable
app.disable(name) turns a documented Boolean Express application setting off by assigning it false. It returns the application instance for continued configuration.
How it works
Call app.disable(name) with the name of a Boolean application setting to set that setting to false. The method changes the application configuration and returns the application object, so it can participate in chained setup; setting a Boolean property to false with app.set() is equivalent.
Syntax
app.disable(name)Parameters
| Name | Type | Description |
|---|---|---|
name | String | Name of the Boolean application setting to disable; it must be one of the properties in the app settings table. |
Returns
Application
Key points
- The method changes the specified Boolean application setting to false.
- The argument names a Boolean setting documented in the application's settings table.
- Using app.set() with false is an equivalent way to disable a Boolean application property.
- The documentation demonstrates disabling the trust proxy setting.
- Reading the disabled trust proxy setting returns false.
Common mistakes
- The name must identify a Boolean setting listed in Express's application settings table; arbitrary non-Boolean configuration names are not documented for this method.
Example: Disable an application setting
const express = require('express');
const app = express();
app.disable('trust proxy');
console.log(app.get('trust proxy')); // false
app.listen(3000);Creates an Express application, disables the Boolean trust-proxy setting, verifies the resulting false value, and starts a server.
When to use it
Disable trust proxy when the deployment should not trust forwarded client information.
Proxy configuration
Configure Boolean application options during startup before serving requests.
Application setup
Interview questions
QWhat does app.disable() do, and what does it return?
app.disable(name) sets the named Boolean application setting to false and returns the Application instance. For a Boolean property, app.set('foo', false) has the same effect.
Follow-up: How would you inspect the result? Use app.get(name), which returns the setting's current value; for a disabled Boolean setting it is false.
QWhat argument does app.disable() accept?
Pass the setting name as a string, such as 'trust proxy'. The name refers to a Boolean property in the application settings table.
Follow-up: What happens if the name is not a documented Boolean application setting? The page does not define behavior for that case, so it should not be relied on.
QHow can you verify a setting disabled by app.disable()?
Disabling 'trust proxy' makes app.get('trust proxy') return false, as shown in the documentation example. This is application configuration rather than route middleware.
Follow-up: What equivalent configuration call is documented? app.set('trust proxy', false) expresses the same Boolean-setting change.
Related
app.enable()app.enabled()app.disabled()app.set()app.get()