Does eliminating "X-Powered-By" header automatically eliminate "Server" header from HTTP response

Question

I am using helmet NPM module to get rid of X-Powered-Bybut not sure about Server header. I have read Remove headers for security but not sure how to get rid of Server header using helmet module.

Answer 1

In short: Helmet doesn't touch the Server header.

I maintain Helmet and there's nothing in it that involves the Server header one way or another. If the header isn't set, Helmet won't set it; if the header is set, Helmet won't remove it.

Express doesn't set the Server header either, as far as I know. That means that this header is coming from somewhere else, likely a server "in front of" your Express server, like nginx.

You can try something like this, but this may not work if there's something "in front of" your server.

app.use(function (req, res, next) {
  res.removeHeader('Server');
  next();
});

The security benefits of removing these headers are minimal anyway, in my opinion. It stops a very small subset of attackers: those who look at these headers to figure out what tech powers your site, try some attacks, and then give up. Attackers have other signs of seeing that your site is Express vulnerabilities. They might also try attacks that aren't Express-specific. Or they might try Express attacks even if they're not sure it's Express! Doug Wilson, the lead maintainer of Express, shares this sentiment.