fix(Server): Disable x-powered-by in production (seek-oss#358)

thebillg · May 13, 2019 · f60574d · f60574d
1 parent d4c3b40
commit f60574d
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/entry/server/server.js b/entry/server/server.js
@@ -18,6 +18,12 @@ if (env === 'development') {
   app.use(express.static(path.join(__dirname, './')));
 }
 
+if (env !== 'development') {
+  // Disable x-powered-by header according to Express Best Practice
+  // https://expressjs.com/en/advanced/best-practice-security.html#at-a-minimum-disable-x-powered-by-header
+  app.disable('x-powered-by');
+}
+
 if (middleware) {
   app.use(middleware);
 }