feat(secure-headers): remove "X-Powered-By" should be an option

[EdamAme-x]

Close #3175

The author should do the following, if applicable

• Add tests
• Run tests
• bun run format:fix && bun run lint:fix to format the code
• Add TSDoc/JSDoc to document the code

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 96.20%. Comparing base (8dc9e48) to head (abe96ee).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3177   +/-   ##
=======================================
  Coverage   96.20%   96.20%           
=======================================
  Files         151      151           
  Lines       15068    15074    +6     
  Branches     2644     2631   -13     
=======================================
+ Hits        14496    14502    +6     
  Misses        572      572           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[ryuapp]

Reasonable thing to add the option.
However, the name should be xPoweredBy to match other formats.
No need for argument extension.

[EdamAme-x]

Thanks @ryuapp
I thought about that too, but quit because I felt the code would be too complicated.
How should I express it?
[string, string]

[watany-dev]

I think it's fine to have an option to disable this setting. However, it seems sufficient to achieve this through the extension of SecureHeadersOptions.

[EdamAme-x]

how about this?
[string, boolean]

[watany-dev]

Understood, this is what I had in mind. I didn't intend to manipulate the HEADERS_MAP

interface SecureHeadersOptions {
  // adding 
  removePoweredBy?: boolean
}

export const secureHeaders = (secureHeadersOptions?: SecureHeadersOptions): MiddlewareHandler => {
  secureHeadersOptions = { ...HEADERS_DEFAULT_OPTIONS, ...secureHeadersOptions }

  const headersToSet = getFilteredHeaders(secureHeadersOptions)
  const callbacks: SecureHeadersCallback[] = []

  if (secureHeadersOptions.contentSecurityPolicy) {
    const [callback, value] = getCSPDirectives(secureHeadersOptions.contentSecurityPolicy)
    if (callback) {
      callbacks.push(callback)
    }
    headersToSet.push(['Content-Security-Policy', value as string])
  }

  if (secureHeadersOptions.reportingEndpoints) {
    headersToSet.push([
      'Reporting-Endpoints',
      getReportingEndpoints(secureHeadersOptions.reportingEndpoints),
    ])
  }

  if (secureHeadersOptions.reportTo) {
    headersToSet.push(['Report-To', getReportToOptions(secureHeadersOptions.reportTo)])
  }

  return async function secureHeaders(ctx, next) {
    // should evaluate callbacks before next()
    // some callback calls ctx.set() for embedding nonce to the page
    const headersToSetForReq =
      callbacks.length === 0
        ? headersToSet
        : callbacks.reduce((acc, cb) => cb(ctx, acc), headersToSet)
    await next()
    setHeaders(ctx, headersToSetForReq)

    if (secureHeadersOptions?.removePoweredBy !== false) {
      ctx.res.headers.delete('X-Powered-By')
    }
  }
}

[EdamAme-x]

Thanks @watany-dev
Understood how the code flows.

[yusukebe]

Hi @EdamAme-x

I've left the comment. Please check it.

[yusukebe]

LGTM!

[yusukebe]

@EdamAme-x Thanks!

This is a feat but a minor change. So, I'll merge it into the main right now and release it as a patch.

[tomByrer]

thanks @EdamAme-x