Why is x-powered-by header showing after installing Express helmet?

Question

I have an Express server running on port 8080 using webpack. I installed helmet as described in the package docs

const express = require('express')
const helmet = require('helmet')
const app = express()
app.use(helmet())

Yet when I npm start I still see the x-powered-by:Express header in localhost and none of the dns-prefetch, xss or other headers that Helmet is supposed to enable. I restarted the server several times, deleted my build folder so it is not cached, and am lost as to why it's not working. Any thoughts or pointers will be greatly appreciated!

Answer 1

You need to explicitly invoke the middleware like so.
const hidePoweredBy = require('hide-powered-by') app.use(hidePoweredBy())

https://expressjs.com/en/advanced/best-practice-security.html

Can also try

app.disable('x-powered-by')