Express: Unable to disable 'x-powered-by' header

Created on 2 Nov 2015 · 9Comments · Source: expressjs/express

Using v4.13.3, I have not been able to disable the 'x-powered-by' response header.

I have tried disabling it in my app config (app.disable('x-powered-by')), and have confirmed that expressInit does not set it, but the response still contains 'x-powered-by'.

Any help in debugging this?

question

Source

a-b-r-o-w-n

👍3

Most helpful comment

Ok. I think I tracked it down. We were using webpack-dev-server to proxy to an express api. Since it uses express the header was being set upstream on the response before our app handled the request.

We just stopped using webpack-dev-server as a proxy and the issue doesn't exist anymore! Thanks for you patience with this.

a-b-r-o-w-n on 11 Nov 2015

👍6 ❤4 🎉3

All 9 comments

I'm not sure. The tests that test disabling are passing. Is there a way you can send me a full app I can run that reproduces this?

dougwilson on 2 Nov 2015

Thanks for the quick reply! From what I can see, express is never explicitly setting the header. Logging res.get('X-Powered-By') in a route handler is undefined.

I will try to make an app to repro this. It will be later in the day or this evening before I can get to it though.

a-b-r-o-w-n on 2 Nov 2015

Perhaps doing a grep for X-Powered-By in your code and in your node_modules could help find different places it could be coming from?

dougwilson on 2 Nov 2015

Hi! I haven't heard anything back. Are you still having an issue or did you find the culprit?

dougwilson on 10 Nov 2015

I didn't ever track down the issue. We ended up setting a custom header instead. I'll spend some more time today to look into this.

a-b-r-o-w-n on 10 Nov 2015

Ok, gotcha. Please keep me updated, especially if this is an Express bug (and you can either provide a way to reproduce OR even go and send us a PR to get in a contribution!).

dougwilson on 11 Nov 2015

Ok. I think I tracked it down. We were using webpack-dev-server to proxy to an express api. Since it uses express the header was being set upstream on the response before our app handled the request.

We just stopped using webpack-dev-server as a proxy and the issue doesn't exist anymore! Thanks for you patience with this.

a-b-r-o-w-n on 11 Nov 2015

👍6 ❤4 🎉3

I accidentally wrote Router = require('express') instead of Router = require('express').Router. Because the API is identical, it's very hard to spot.

Hope this saves time someone like me :laughing:

suprMax on 15 Feb 2016

👍2

I accidentally wrote Router = require('express') instead of Router = require('express').Router. Because the API is identical, it's very hard to spot.

Thanks, I just struggled with this for a while.

As @suprMax pointed out, you have to use Router if you want to apply the application config also to nested routers that are included like this: app.use('/myrouter', myRouter).