fix: stop sending x-powered-by on docs responses

changelog.d/security-370-powered-by-header.md

@@ -0,0 +1,2 @@
+- The docs site no longer sends `x-powered-by: Next.js` on responses
+  (`poweredByHeader: false` in `next.config.ts`, hivecommons/docs#370).

next.config.ts

@@ -18,6 +18,8 @@ const nextConfig: NextConfig = {
     optimizePackageImports: ["@/components"],
   },
   pageExtensions: ["js", "jsx", "ts", "tsx", "md", "mdx"],
+  // Do not advertise the framework on every response (x-powered-by).
+  poweredByHeader: false,
   async headers() {
     // Content-Security-Policy for the docs site.
     // - default-src 'self': blocks all unlisted resource types by default.

src/__tests__/next-config-headers.test.ts

@@ -29,6 +29,7 @@ let headerRules: HeaderRule[];
 let rewrites: Rewrite[];
 let redirects: Redirect[];
 let pageExtensions: string[];
+let poweredByHeader: boolean | undefined;
 let siteHeaders: Map<string, string>;
 let csp: Map<string, string[]>;
 
@@ -38,6 +39,7 @@ beforeAll(async () => {
   rewrites = (await config.rewrites!()) as Rewrite[];
   redirects = (await config.redirects!()) as Redirect[];
   pageExtensions = config.pageExtensions!;
+  poweredByHeader = config.poweredByHeader;
 
   const siteWide = headerRules.find(r => r.source === "/(.*)");
   expect(siteWide, "a site-wide header rule for /(.*)").toBeDefined();
@@ -74,6 +76,12 @@ describe("next.config.ts site-wide security headers", () => {
     }
   });
 
+  it("does not advertise the framework via x-powered-by", () => {
+    // Next.js defaults poweredByHeader to true; the flag must be set
+    // explicitly to false, not merely left undefined.
+    expect(poweredByHeader).toBe(false);
+  });
+
   it("sends HSTS for at least one year with includeSubDomains and preload", () => {
     const hsts = siteHeaders.get("Strict-Transport-Security")!;
     const maxAge = Number(/max-age=(\d+)/.exec(hsts)?.[1]);