# httpServerOptions (settings.js) does not accept settings

**URL:** <https://discourse.nodered.org/t/httpserveroptions-settings-js-does-not-accept-settings/10627>\
**Category:** General\
**Created:** [28 April 2019 20:48 UTC](https://discourse.nodered.org/t/httpserveroptions-settings-js-does-not-accept-settings/10627 "2019-04-28T20:48:27Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![adamiD](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/adamid/32/7958_2.png) [@adamiD](https://discourse.nodered.org/u/adamiD)\
**Post date:** [28 April 2019 20:48 UTC](https://discourse.nodered.org/t/httpserveroptions-settings-js-does-not-accept-settings/10627/1 "2019-04-28T20:48:27Z")

</div>

Hello guys,

I am using the latest version (0.20.5) without any problem, but when I try to configure (httpServerOptions) it does not work on any "expressjs" settings.

```auto
    // The following property can be used to pass custom options to the Express.js
    // server used by Node-RED. For a full list of available options, refer
    // to http://expressjs.com/en/api.html#app.settings.table

    httpServerOptions: {
        "x-powered-by": false
    },

    // The following property can be used to verify websocket connection attempts.
    // This allows, for example, the HTTP request headers to be checked to ensure
    // they include valid authentication information.

```

Any idea where my mistake will be?

Alternatively I set up an (http response) with the same value (x-powered-by).

Thank you for your help!

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [29 April 2019 11:18 UTC](https://discourse.nodered.org/t/httpserveroptions-settings-js-does-not-accept-settings/10627/2 "2019-04-29T11:18:19Z")

</div>

Hi @adamiD

I couldn't remember how we handle this in the code, and having reviewed it, I see we only apply these options to the routes that serve the editor and its apis. They do _not_ apply to the routes served by the HTTP nodes.

So that explains what you're seeing. Whether it should apply to the HTTP node routes is another question. Need to think about that.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [29 April 2019 12:33 UTC](https://discourse.nodered.org/t/httpserveroptions-settings-js-does-not-accept-settings/10627/3 "2019-04-29T12:33:16Z")

</div>

> [@adamiD](#):
>
> Alternatively I set up an (http response) with the same value (x-powered-by).

A workaround would be to use a reverse proxy to do it. That tends to be more secure anyway since web servers/reverse proxies tend to be heavily security tested. NGINX or HAProxy are good and pretty efficient choices. Apache can be used as well but tends to be a bit (lot) more of a resource hog in my experience.

---

<div class="post-metadata">

**Author:** ![adamiD](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/adamid/32/7958_2.png) [@adamiD](https://discourse.nodered.org/u/adamiD)\
**Post date:** [29 April 2019 20:37 UTC](https://discourse.nodered.org/t/httpserveroptions-settings-js-does-not-accept-settings/10627/4 "2019-04-29T20:37:50Z")

</div>

Hello @TotallyInformation,

I also have a preference for NGINX, until I say more, after using it, I never thought about Apache... hehehe  
For the case in question I just wanted to hide the header.

Thanks for sharing,  
Doug

---

<div class="post-metadata">

**Author:** ![adamiD](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/adamid/32/7958_2.png) [@adamiD](https://discourse.nodered.org/u/adamiD)\
**Post date:** [29 April 2019 20:46 UTC](https://discourse.nodered.org/t/httpserveroptions-settings-js-does-not-accept-settings/10627/5 "2019-04-29T20:46:37Z")

</div>

Hello @knolleary,

Thanks for the clarification ... I thought the option affected the whole context ... I thought it was my mistake, so what is the best option to hide the header in the HTTP node routes? What is your recommendation?

I take this opportunity to thank you for the excellent work you have done.  
Doug

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [1 December 2019 15:19 UTC](https://discourse.nodered.org/t/httpserveroptions-settings-js-does-not-accept-settings/10627/6 "2019-12-01T15:19:02Z")

</div>

Hi, just resurrecting this because:

1. It looks like the options are completely ignored even for the editor  
 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/2X/2/29e33c556b34b57a2d64102b3b546dd36f80a8c4.png) ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/2X/b/b740219bc77b8fa479f246b4da73d0f6219a8384.png)

2. I've been looking at Node-RED security again and there are several settings that I believe would be beneficial to improve the general security of Node-RED. I think that these settings probably should be on by default though almost certainly need to be options.