Q:

In Node.js/Express, how do I automatically add this header to every "render" response? 

I have many of these "controllers":  
app.get('/',function(req,res){
    var stuff = { 'title': 'blah' };
    res.render('mytemplate',stuff);
});    

Notice res.render?  I want to add this header to every response header I make:
X-XSS-Protection: 0
How can I add that response header automatically? 

A:

You probably want to use app.use with your own middleware:
app.use(function(req, res, next) {
    res.header('X-XSS-Protection', 0);
    next();
});

A:

// global controller
app.get('/*',function(req,res,next){
    res.header('X-XSS-Protection' , 0 );
    next(); // http://expressjs.com/guide.html#passing-route control
});

Just make sure this is the first controller you add, order is significant. 

A:

For express 4.x, the idiomatic way is as follows:
Implementation
// no mount path; executed for every request. 
app.use(function (req, res, next) {
  res.set('X-XSS-Protection', 0);
  next();
});

Test
describe('Response Headers', function () {
  it('responds with header X-XSS-Protection: 0', function (done) {
    hippie(app)
    .get('/any/route/you/can/think/of')
    .expectHeader('X-XSS-Protection', 0)
    .end(done);
  });
});

Dev Dependencies (for tests to work)
% npm install --save-dev mocha hippie

Relevant Documentation

Application Level Middleware
res.set

