# "X-Powered-By: Express" still present in /theme responses

**URL:** <https://discourse.nodered.org/t/x-powered-by-express-still-present-in-theme-responses/78383>\
**Category:** Core Development\
**Tags:** security\
**Created:** [12 May 2023 13:01 UTC](https://discourse.nodered.org/t/x-powered-by-express-still-present-in-theme-responses/78383 "2023-05-12T13:01:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![fmp](https://avatars.discourse-cdn.com/v4/letter/f/7bcc69/32.png) [@fmp](https://discourse.nodered.org/u/fmp)\
**Post date:** [12 May 2023 13:01 UTC](https://discourse.nodered.org/t/x-powered-by-express-still-present-in-theme-responses/78383/1 "2023-05-12T13:01:57Z")

</div>

I am trying to remove the "x-powered-by" header from all Node-RED API responses because of a pentest finding.

As I see this should have already been done:

[Ensure httpServerOptions gets applied to ALL the express apps · node-red/node-red@a9b252b (github.com)](https://github.com/node-red/node-red/commit/a9b252b8fa5ae3cafb1fbadf421095fadeb8fe02)

But it seems, that for theme path the header is still set.  
[https://localhost:1880/theme](https://localhost:1880/theme)  
[https://localhost:1880/theme/login/node-red-256-P.png](https://localhost:1880/theme/login/node-red-256-P.png)

Response-Header:  
X-Powered-By: Express

Node v16.20.0  
Node-RED v3.0.2

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [12 May 2023 15:52 UTC](https://discourse.nodered.org/t/x-powered-by-express-still-present-in-theme-responses/78383/2 "2023-05-12T15:52:23Z")

</div>

Can you raise an issue on GitHub so it can be looked at?

---

<div class="post-metadata">

**Author:** ![fmp](https://avatars.discourse-cdn.com/v4/letter/f/7bcc69/32.png) [@fmp](https://discourse.nodered.org/u/fmp)\
**Post date:** [15 May 2023 15:20 UTC](https://discourse.nodered.org/t/x-powered-by-express-still-present-in-theme-responses/78383/3 "2023-05-15T15:20:16Z")

</div>

[# X-Powered-By: Express](https://github.com/node-red/node-red/issues/4169)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [14 July 2023 15:21 UTC](https://discourse.nodered.org/t/x-powered-by-express-still-present-in-theme-responses/78383/4 "2023-07-14T15:21:03Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.