node.js - 如何防止经验丰富的攻击者知道您的应用程序是由生产中的 Express.js 提供支持的？

Question

我希望在生产中运行一个express.js应用程序，我最不想看到的就是让任何人知道它是由express.js或一般 Node 提供支持的。我读了这篇文章:

https://expressjs.com/en/advanced/best-practice-security.html

并且确定我需要移除 X-Powered-By(无论我是否使用 Helm )。

令我困扰的是文章中的陈述:

Note: Disabling the X-Powered-By header does not prevent a sophisticated attacker from determining that an app is running Express. It may discourage a casual exploit, but there are other ways to determine an app is running Express.

攻击者还可以通过哪些其他方式检测正在运行的express.js 应用程序以及如何防范这种情况？

Answer 1

This评论可能会让您感兴趣。我复制粘贴了以下几点:

Common methods to detect if a server is running Express

1. Are there response headers all in lower-case? The more there are, the more points assigned as likely being Node.js server, which in turn counts towards Express.js.
2. Some requests to random URLs are made looking for a 404. If the response body is in the format "Cannot GET {url}" then it gives a massive number of points towards it being Express.js. This is actually the main give away it uses to know you are an Express.js server.
3. What does the ETag header look like if there is one? There are definitions for the different versions of the ETag header format for Express.js, so this header matching certain formats not only gives points towards being Express.js, but even hints at the version of Express.js you are using, since the format has changed over time (even the X-Powered-By header doesn't provide that level of detail, since it does not contain a version).