feat: disable x-powered-by header (#223)

* feat: disable x-powered-by header Signed-off-by: Grant Timmerman <timmerman+devrel@google.com> * fix: fix lint Signed-off-by: Grant Timmerman <timmerman+devrel@google.com>
GoogleCloudPlatform · Oct 2, 2020 · 1ca74ae · 1ca74ae
1 parent 9e447e9
commit 1ca74ae
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/src/server.ts b/src/server.ts
@@ -93,6 +93,9 @@ export function getServer(
   // Subsequent parsers will be skipped when one is matched.
   app.use(bodyParser.raw(rawBodySavingOptions));
   app.enable('trust proxy'); // To respect X-Forwarded-For header.
+  // Disable Express 'x-powered-by' header:
+  // http://expressjs.com/en/advanced/best-practice-security.html#at-a-minimum-disable-x-powered-by-header
+  app.disable('x-powered-by');
 
   registerFunctionRoutes(app, userFunction, functionSignatureType);
   return http.createServer(app);