Remove X-Powered-By: React/alpha or make optional

[andyfleming]

For security reasons, among others, we should remove the X-Powered-By header.

[WyriHaximus]

I'm in favor of this by passing an option array to the Server which passes a default headers array into the Response constructor. Any opinions on this @jsor @clue @cboden?

[clue]

I agree that we should add an option to turn this off (though I'm not considering this to be security feature) 👍

[jsor]

👍

[clue]

I stumbled upon this while preparing a fix for #51.

You can actually omit sending the X-Powered-By header by explicitly setting an empty header value like this:

$response->writeHead(200, array('X-Powered-By' => array()));

I believe this should answer this ticket, but I'll leave this open until I've filed my upcoming PR that adds some documentation for this 👍

[andyfleming]

It's a form of information disclosure and should be off by default.

[clue]

This is now documented behavior via #107, do you feel this needs further changes?

FWIW, PHP also exposes a similar header by default, unless configured otherwise: http://php.net/manual/en/ini.core.php#ini.expose-php

[WyriHaximus]

@clue tbh I agree with @andyfleming here, we're disclosing information we probably shouldn't from a security perspective. I know PHP, Nginx, Apache, Varnish etc etc all expose that but I won't consider that a good security practice. And while we're making breaking changes for 0.5.0 and 0.6.0 I wouldn't mind fixing this.

[andyfleming]

Most (if not all) of those have options to turn off the powered by header. It's a recommended best practice to not expose the service and version. It's to avoid revealing that a server is running an vulnerable (unpatched) version of a service.

[clue]

Most (if not all) of those have options to turn off the powered by header.

So does this component?

I'm really not saying I disagree here, but what do you suggest? Can you file a PR that addresses the issue you're seeing? Thanks!

@WyriHaximus Sounds like a reasonable plan! I suppose we'll likely have to resolve this once #28 lands anyway, because creating the response object will likely be left up to the user anyway, so there's little chance for us to add any "default headers".

[andyfleming]

I'm not seeing any issue, per se, just suggesting we be Secure by Default.

It's not a big deal at all. Just advocating for best practices.