apollo-server: Disable "x-powered-by" header

[pauloedurezende]

• This new feature adds a new server configuration option so that the developer can disable information that is reported in the response header (like x-powered-by) on Express server - Consider providing an option to disable the "x-powered-by" header #3812

[andrewmcgivery]

Just curious if this should be more discussed per my comment in #3812 instead of just rushing in a root level property.

More specifically, would it be useful to be able to both add and remove headers through something like this instead of just disabling headers.

Maybe something like this?

headers: {
   add: [{'X-Content-Type-Options', 'nosniff'}]
   remove: ['x-powered-by']
}

[abernix]

I don't think a top-level attribute to the ApolloServer class is the right way to achieve this (nor do I think disable as a term provides near enough clarity as to what that option would be meant to achieve).

While it's not currently the case, the ApolloServerCore class is meant to be as HTTP-agnostic as possible. Future versions of Apollo Server will make this even more strict to ensure we don't conflate transport concerns with GraphQL server functionality.

I do think that the ability to add headers is a great option for the transport, but that seems it should be accomplished in a transport-specific way on the HTTP transport which #3576 introduced and that is part of the larger #3184 work in #2360. While it might be tempting to open a PR to that PR, I wouldn't suggest that just yet until we stabilize some of the 3.0 work, and most notably that transport.

How about changing this PR to resolve exactly what #3812 reported? Specifically, that means disabling the default Express header when using apollo-server (not any of other integrations) by adding app.disable('x-powered-by'); below this line:

apollo-server/packages/apollo-server/src/index.ts

Lines 98 to 99 in 30b3066

	const app = express();

Thoguhts?

[pauloedurezende]

Guys, thanks to review this PR 😄

It ended up being my fault to pay more attention to the proposed alternative than to actually solve the specific problem, even more, focused only on one server, in this case, Express. I will make the necessary changes to be able to deliver the correction of the proposed problem... 😉