Change:
As a reminder, this project is being built upon the following starter project on [Repl.it](https://repl.it/github/freeCodeCamp/boilerplate-infosec), or cloned from [GitHub](https://github.com/freeCodeCamp/boilerplate-infosec/). <del> Hackers can exploit known vulnerabilities in Express/Node if they see that your site is powered by Express. X-Powered-By: Express is sent in every request coming from Express by default. The `helmet.hidePoweredBy()` middleware will remove the X-Powered-By header. You can also explicitly set the header to something else, to throw people off. e.g. `app.use(helmet.hidePoweredBy({ setTo: 'PHP 4.2.0' }))` </del> <ins> Hackers can exploit known vulnerabilities in Express/Node if they see that your site is powered by Express. `X-Powered-By: Express` is sent in every request coming from Express by default. Use the `helmet.hidePoweredBy()` middleware to remove the X-Powered-By header. </ins> # --hints--

Discussion:
<!-- NOTE: If you're reporting a security issue, don't create a GitHub issue. Instead, email We will look into it immediately. --Describe your problem and how to reproduce it: In the first Helmet challenge it is said that to hide the X-powered-By set by default in some servers, can help to avoid attacks. I'm not saying this isn't true, but this is an extract from Helmet: They have an interesting side note for express:
Hello there, Thank you, for taking the time to open this. I am not sure I understand what you are saying needs to happen/ be changed? The current boilerplate file has what you mentioned: The idea behind the lesson is not how to use Helmetjs for Express apps, but what security measures exist, and what do they do.
You're welcome. I'd just include or link to helmet npm at least, or include that paragraph, because it's not really useful for security, as far as I can see. I mean, the exercise is to include Feel free to close it if it doesn't really help, no problem. I've read the boilerplate, it was great to see that :+1:
Ok, after doing more searching into this, I agree there are two things we might benefit from doing: 1) With the version we have set to be installed and used, can take arguements, but version cannot. So, I would suggest a camper not use an option. I.e. remove 2) Add some information along the lines of:
Yes, that'd be great, I was puzzled by the option too, cause they don't include it in the home page at least. Also, 3.21.3 isn't passing the exercise (the first one), don't know if this is just me, or there is some other update to do. Oops, just found out we need to remove from
I dunno, I really don't see much of a problem here. The challenge says that "Hackers can exploit known vulnerabilities in Express/Node if they see that your site is powered by Express." So it doesn't really claim that it adds security, more that it throws people off. Certainly, a determined person could figure out what is powering the app, this just makes it a little harder.

Since the version of helmet we are using allows for the option to set the header, I don't mind leaving that in - I suppose removing would probably be better at this point - although, only slightly. It's certainly nice to update lessons when a package changes, but it's also difficult to keep things up to date. The method works with helmet v3 and v4 so I'm not sure why it's suggested to use that. One thing that does bother me here is that the boilerplate has the that pointed out. So if you want to actually see the header, you can't without removing that line no matter what method or options you use. My vote goes to just removing that line from the boilerplate. I actually don't mind making adjustments to this, but I don't think it's particularly necessary or that the current lesson is inaccurate. Part of my suggestion has to do with the translation effort taking place with the curriculum. When a lesson changes, we will need to start updating it in across all languages. So a minor fix like this becomes a significant effort. All that being said - if the consensus is to make some changes, I won't fight it. If we do end up changing it, I would say to switch to the method. Side note: the method that's used a few lessons after this was removed in helmet v4.
That's not true just initiate the app, you'll see the header. Indeed, they use app.disable(...) cause that's what they recommend in Helmet, which is another reason to leave that header out, mostly when most users are using express, and the exercise itself. (To see the header just include the route in , instead of ) My point is: you don't want people to learn a useless setting. Idk, seems to me the whole section is rather weak.