Server fingerprinting misconfiguration


ID: javascript-express/reduce-server-fingerprinting

Language: JavaScript

Severity: Warning

Category: Security


Improve your overall server security by taking the step to reduce the likelihood of server fingerprinting the software being used on the server.

By default, Express.js sends the X-Powered-By response header banner which can be disabled with app.disable('X-Powered-By').

If you’re using helmet, you can use either of these methods too:

  • app.use(hidePoweredBy())
  • app.use(helmet.hidePoweredBy())

Learn More

Non-Compliant Code Examples

const app = express()

// express() is called but none of the following were detected afterwards
// app.disable('x-powered-by')
// app.use(hidePoweredBy())
// app.use(helmet.hidePoweredBy())

Compliant Code Examples

const app = express()


// rest of your config
const app = express()


// rest of your config
const app = express()


// rest of your config jetbrains

Seamless integrations. Try Datadog Code Analysis