Express apps deployed with default settings expose fingerprinting headers (X-Powered-By), lack security headers, and commonly ship known-vulnerable dependencies.
Fix: Use helmet to set security headers, disable/obscure X-Powered-By, enforce TLS, set cookie security options (httpOnly, secure), and audit dependencies for known vulnerabilities — all per Express's own security best-practices doc rather than hand-rolled header code.
securityhttp-headersnodejs
References
- https://expressjs.com/en/advanced/best-practice-security.html — Officially recommends Helmet, TLS, secure cookie settings, and dependency vulnerability auditing for production Express apps.