1. What is X-Powered-By / Server

Many of us may not notice this http header until we use a security scan tool to scan our website. And we notice that those tools often suggest us to remove this kind of header, for 2 reasons:

1. Make http header more slight
2. Avoid potential vulnerability.

So let's have a look at this header.

node index.js

This header suggests that our backend is supported by Express.

Other sample:

Those can leak the backend server information. As we know, for Apache, IIS, there are some special security bugs. If a hacker knows which server a website is using and potential bugs of this kind of server, some attacks may be taken.

2. How to fix

How can we remove this kind of http header then?

Different backends have different configurations. Here we only cover our sample: Express.

In Express, we also use Helmet.

In indexSafe.js :

...
app.use(bodyParser.urlencoded({
  extended: true
}));
app.use(bodyParser.json());
app.use(helmet.referrerPolicy({ policy: 'same-origin' }));
app.disable('x-powered-by');
...

Now start again:

node indexSafe.js

There will be no server information any more.