strongloop / express

100%

master: 100%

LAST BUILD ON BRANCH 5.0

branch: 5.0

CHANGE BRANCH

x

Reset

• 5.0
• for-freenode-irc
• master
• fabien-fix/app-use-mw-mount
• 4.8.0
• 3.16.0
• 4.8.1
• 4.7.3
• 3.x
• 3.15.3
• 4.7.4
• 3.16.1
• 3.16.2
• 4.8.2
• 3.16.3
• 3.16.4
• 4.8.3
• 3.16.5
• 3.16.6
• 3.16.7
• 4.8.4
• 4.8.5
• 4.9
• 3.17
• 3.16.8
• 4.8.6
• 3.16.9
• 4.8.7
• 3.16.10
• 4.8.8
• 3.17.0
• 3.17.1
• 4.9.0
• 3.17.2
• 4.9.1
• 4.9.2
• 3.17.3
• 4.9.3
• 3.17.4
• 4.9.4
• 3.17.5
• 4.9.5
• 3.17.6
• 3.17.7
• 4.9.7
• readme-updates
• 4.10
• module-updates
• 3.17.8
• 4.9.8
• 4.9.9
• 3.18.0
• 3.18.1
• 4.10.0
• iterative-router
• 3.18.2
• 4.10.1
• feature/customizable-router
• 5.x
• 4.x
• 5.0.0-alpha.1
• 3.18.3
• 4.10.2
• 3.18.4
• 4.10.3
• 4.11
• 4.10.4
• 4.10.5
• 3.18.5
• 3.18.6
• 4.10.6
• 4.10.7
• 3.19.0
• 4.10.8
• 4.11.0
• 3.19.1
• 4.11.1
• 3.19.2
• 4.11.2
• appveyor
• 3.20.0
• 4.12
• node_08_4
• 4.12.0
• 3.20.1
• 4.12.1
• 4.12.2
• 3.20.2
• 4.12.3
• external-isAbsolute
• 3.20.3
• 4.12.4
• 4.13
• 3.21.0
• fce3d14
• 4.13.0
• 3.21.1
• 4.13.1
• 5.0.0-alpha.2
• 3.21.2
• 4.13.2
• 4.13.3
• add-security-process
• async-route-handlers
• fix-readme-link

Build # 2530

Build Type

Pull #2813

travis-ci

Committed by madarche

Commit Message

Security improvement: don't reveal powered-by

The first thing recommended when setting up an Express instance is to
secure it by removing its "X-Powered-By" header.

https://www.npmjs.com/package/helmet
https://blog.risingstack.com/node-js-security-checklist/
https://strongloop.com/strongblog/best-practices-for-express-in-production-part-one-security/

So let's save cycles by not setting this header in the first place.

This header is also totally useless. If some people are needing it
somewhere for a very specific usecase they can add a little custom
middleware that returns the "X-Powered-By" header again.

Pull Request Pull Request #2813: Security improvement: don't reveal powered-by

Run Details

1333 of 1335 relevant lines covered (99.85%)

555.02 hits per line