After researching the express documentation and Stack Overflow, it seems like I can remove the X-Powered-By: Express header by using app.disable('x-powered-by'). You can find the documentation for app.disable here, and the list of toggleable settings here.
This is a basic express server setup:
// src/server.js
import express from 'express'
import logger from 'morgan'
import router from './routes/index.js'
export const createServer = () => {
const app = express()
app.disable('x-powered-by')
app.use(logger('dev'))
app.use(express.json())
app.use(express.urlencoded({ extended: true }))
app.use(router)
return app
}
const app = createServer()
export default app
// src/index.js
import { SERVER_PORT, SERVER_ORIGIN } from './config/index.js'
import app from './server.js'
const port = parseInt(SERVER_PORT, 10)
const server = app.listen(port, () => {
console.info(`[Server] ${SERVER_ORIGIN}.`)
})
export default server
Even though I have included app.disable('x-powered-by') right after creating the app, when testing with curl the header still appears:
$ curl localhost:5000 -v
* Trying 127.0.0.1:5000...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 5000 (#0)
> GET / HTTP/1.1
> Host: localhost:5000
> User-Agent: curl/7.65.3
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< X-Powered-By: Express
< Content-Type: application/json; charset=utf-8
< Content-Length: 16
< ETag: W/"10-/VnJyQBB0+b7i4NY83P42KKVWsM"
< Date: Wed, 22 Apr 2020 12:08:35 GMT
< Connection: keep-alive
<
* Connection #0 to host localhost left intact
{"message":"ok"}
I even attempted changing the capitalization (app.disable('X-Powered-By')), but unfortunately, it didn't make a difference. What could be causing this issue?