Server fingerprinting misconfiguration
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
ID: javascript-express/reduce-server-fingerprinting
Language: JavaScript
Severity: Warning
Category: Security
CWE: 693
Description
Improve your overall server security by taking the step to reduce the likelihood of server fingerprinting the software being used on the server.
By default, Express.js sends the X-Powered-By response header banner which can be disabled with app.disable('X-Powered-By').
If you’re using helmet, you can use either of these methods too:
app.use(hidePoweredBy())app.use(helmet.hidePoweredBy())
Learn More
Non-Compliant Code Examples
const app = express()
// express() is called but none of the following were detected afterwards
// app.disable('x-powered-by')
// app.use(hidePoweredBy())
// app.use(helmet.hidePoweredBy())
Compliant Code Examples
const app = express()
app.use(helmet.hidePoweredBy());
// rest of your config
const app = express()
app.use(hidePoweredBy())
// rest of your config
const app = express()
app.disable('x-powered-by')
// rest of your config
