Disable the identifying header
Reduce framework fingerprinting in production responses.
Express.js · Const
x-powered-by
x-powered-by is a Boolean Express application setting enabled by default. It controls whether responses include the X-Powered-By: Express header.
How it works
Express stores this application setting as a Boolean that defaults to true. When enabled, responses include the X-Powered-By: Express header; use the application’s disable method with this setting name to turn it off.
Syntax
app.set('x-powered-by', Boolean)Key points
- The setting is named
x-powered-by, accepts a Boolean, and is enabled by default. - When enabled, Express emits an
X-Powered-By: Expressresponse header. - Mounted Express sub-applications inherit the setting value from their parent application.
- A newly configured Express application sends this response header unless the setting is changed.
Common mistakes
- Turning the setting off is not a complete defense against identifying Express, because more sophisticated detection methods remain possible.
Example: Disable the Express power-by header
const express = require('express');
const app = express();
app.disable('x-powered-by');
app.get('/', (req, res) => {
res.send('Hello');
});
app.listen(3000);Creates an Express app and disables the identifying response header before serving requests.
When to use it
Configure parent and sub-app settings
Keep consistent application configuration across mounted Express applications.
Manage application settings
Inspect or change framework response behavior during setup.
Interview questions
QWhat does the x-powered-by setting control?
It is an Express application setting named x-powered-by. Its Boolean default is true, which enables the X-Powered-By: Express HTTP response header.
Follow-up: How would you disable it? Call app.disable('x-powered-by') during application setup.
QHow do you turn off the header?
Use app.disable('x-powered-by'). This disables the default header that identifies Express in responses.
Follow-up: Does disabling it guarantee that Express cannot be identified? No; the documentation says sophisticated attackers may still determine that the app uses Express.
QWhat happens when an Express sub-app is mounted?
The setting is inherited by sub-applications. Therefore, a mounted sub-app inherits the parent application's value unless its configuration changes it.
Follow-up: What type of setting is it? It is a Boolean application setting, and its default value is true.
Related
app.disable()app.enable()app.enabled()app.get()trust proxy