29 lines
826 B
Plaintext
29 lines
826 B
Plaintext
|
include::../description.adoc[]
|
||
|
|
|
||
|
|
== Noncompliant Code Example
|
||
|
|
|
||
|
|
https://www.npmjs.com/package/express[Express.js] name is disclosed by default into the <code>x-powered-by</code> HTTP header:
|
||
|
|
----
|
||
|
|
let express = require('express');
|
||
|
|
let app = express(); // Noncompliant
|
||
|
|
|
||
|
|
app.get('/', function (req, res) {
|
||
|
|
res.send('hello')
|
||
|
|
});
|
||
|
|
----
|
||
|
|
|
||
|
|
== Compliant Solution
|
||
|
|
|
||
|
|
<code>x-powered-by</code> HTTP header should be disabled in https://www.npmjs.com/package/express[Express.js] with <code>app.disable</code> or with https://www.npmjs.com/package/hide-powered-by[Hide X-Powered-By] middleware:
|
||
|
|
----
|
||
|
|
let express = require('express');
|
||
|
|
let app1 = express(); // Compliant
|
||
|
|
app1.disable("x-powered-by");
|
||
|
|
|
||
|
|
let hidePoweredBy = require('hide-powered-by');
|
||
|
|
let app2 = express(); // Compliant
|
||
|
|
app2.use(hidePoweredBy());
|
||
|
|
----
|
||
|
|
|
||
|
|
include::../see.adoc[]
|