Server fingerprinting misconfiguration

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Metadata

ID: typescript-express/reduce-server-fingerprinting

Language: TypeScript

Severity: Warning

Category: Security

CWE: 693

Description

Improve your overall server security by taking the step to reduce the likelihood of server fingerprinting the software being used on the server.

By default, Express.js sends the X-Powered-By response header banner which can be disabled with app.disable('X-Powered-By').

If you’re using helmet, you can use either of these methods too:

  • app.use(hidePoweredBy())
  • app.use(helmet.hidePoweredBy())

Learn More

Non-Compliant Code Examples

const app: Express = express();

// express() is called but none of the following were detected afterwards
// app.disable('x-powered-by')
// app.use(hidePoweredBy())
// app.use(helmet.hidePoweredBy())

Compliant Code Examples

const app: Express = express();

app.use(helmet.hidePoweredBy());

// rest of your config
const app: Express = express();

app.use(hidePoweredBy())

// rest of your config
const app: Express = express();

app.disable('x-powered-by')

// rest of your config
https://static.datadoghq.com/static/images/logos/github_avatar.svg https://static.datadoghq.com/static/images/logos/vscode_avatar.svg jetbrains

Seamless integrations. Try Datadog Code Analysis