{"action":"created","issue":{"url":"https://api.github.com/repos/strongloop/express/issues/2821","labels_url":"https://api.github.com/repos/strongloop/express/issues/2821/labels{/name}","comments_url":"https://api.github.com/repos/strongloop/express/issues/2821/comments","events_url":"https://api.github.com/repos/strongloop/express/issues/2821/events","html_url":"https://github.com/strongloop/express/issues/2821","id":120164927,"number":2821,"title":"x-powered-by shouldn't be sent by default","user":{"login":"sampsakuronen","id":1944139,"avatar_url":"https://avatars.githubusercontent.com/u/1944139?v=3","gravatar_id":"","url":"https://api.github.com/users/sampsakuronen","html_url":"https://github.com/sampsakuronen","followers_url":"https://api.github.com/users/sampsakuronen/followers","following_url":"https://api.github.com/users/sampsakuronen/following{/other_user}","gists_url":"https://api.github.com/users/sampsakuronen/gists{/gist_id}","starred_url":"https://api.github.com/users/sampsakuronen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sampsakuronen/subscriptions","organizations_url":"https://api.github.com/users/sampsakuronen/orgs","repos_url":"https://api.github.com/users/sampsakuronen/repos","events_url":"https://api.github.com/users/sampsakuronen/events{/privacy}","received_events_url":"https://api.github.com/users/sampsakuronen/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-12-03T12:57:24Z","updated_at":"2015-12-03T13:39:23Z","closed_at":"2015-12-03T13:39:23Z","body":"Express sends `X-Powered-By: Express` header by default.\r\n\r\nIt exposes a fact about your stack which is a real risk. I think this behaviour exists for marketing purposes, although it would surprise me if somebody discovered or chose Express because of this header.\r\n\r\nMy default pattern is to `app.disable('x-powered-by')` in every project that I work on. I think that [many others do this as well](https://www.google.com/search?q=disable+express+powered-by+header).\r\n\r\nIs there a reason for this information disclosure besides the marketing point of view? I think the setting should be `false` by default. It's a small change and I can do a pull request for it if wanted.\r\n\r\nThis behavior was introduced in 5ac631a "},"comment":{"url":"https://api.github.com/repos/strongloop/express/issues/comments/161642255","html_url":"https://github.com/strongloop/express/issues/2821#issuecomment-161642255","issue_url":"https://api.github.com/repos/strongloop/express/issues/2821","id":161642255,"user":{"login":"dougwilson","id":67512,"avatar_url":"https://avatars.githubusercontent.com/u/67512?v=3","gravatar_id":"","url":"https://api.github.com/users/dougwilson","html_url":"https://github.com/dougwilson","followers_url":"https://api.github.com/users/dougwilson/followers","following_url":"https://api.github.com/users/dougwilson/following{/other_user}","gists_url":"https://api.github.com/users/dougwilson/gists{/gist_id}","starred_url":"https://api.github.com/users/dougwilson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dougwilson/subscriptions","organizations_url":"https://api.github.com/users/dougwilson/orgs","repos_url":"https://api.github.com/users/dougwilson/repos","events_url":"https://api.github.com/users/dougwilson/events{/privacy}","received_events_url":"https://api.github.com/users/dougwilson/received_events","type":"User","site_admin":false},"created_at":"2015-12-03T13:39:23Z","updated_at":"2015-12-03T13:39:23Z","body":"Hi! We won't be making this change, unfortunately. You can read more about the reason at https://github.com/strongloop/express/pull/2813#issuecomment-159270428 .\r\n\r\nThe header is for marketing, just like many other things like ASP.Net and PHP do. It actually does make a difference in that regard, even if you may not believe so.\r\n\r\nAny attack software will simply run Express or Node.js attacks against your server regardless of the header."}}