feat(http-helmet): remove insecure response headers

.changeset/tidy-lions-protect.md

@@ -0,0 +1,5 @@
+---
+"@mcansh/http-helmet": patch
+---
+
+Add `removeInsecureHeaders` to remove server-identifying response headers maintained by the OWASP Secure Headers Project.

.github/workflows/update-removal-headers.yml

@@ -0,0 +1,153 @@
+name: 🛡️ Update removal headers
+
+on:
+  schedule:
+    - cron: "17 13 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: update-http-helmet-removal-headers
+  cancel-in-progress: false
+
+jobs:
+  update:
+    name: 🛡️ Update removal headers
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: ⬇️ Checkout repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.repository.default_branch }}
+
+      - name: 🛡️ Update removal headers and pull request
+        shell: bash
+        env:
+          BASE_BRANCH: ${{ github.event.repository.default_branch }}
+          CHANGESET_PATH: .changeset/update-http-helmet-removal-headers.md
+          GH_TOKEN: ${{ github.token }}
+          OUTPUT_PATH: packages/http-helmet/src/removal-headers.ts
+          SOURCE_URL: https://raw.githubusercontent.com/OWASP/www-project-secure-headers/refs/heads/master/ci/headers_remove.json
+          UPDATE_BRANCH: automation/update-removal-headers
+        run: |
+          set -euo pipefail
+
+          response_file=$(mktemp)
+          trap 'rm -f "$response_file"' EXIT
+
+          curl \
+            --fail \
+            --location \
+            --max-filesize 1048576 \
+            --max-time 30 \
+            --proto '=https' \
+            --proto-redir '=https' \
+            --retry 3 \
+            --show-error \
+            --silent \
+            --tlsv1.2 \
+            "$SOURCE_URL" \
+            --output "$response_file"
+
+          response_size=$(wc -c < "$response_file")
+          if (( response_size > 1048576 )); then
+            echo "OWASP response exceeded the 1 MiB limit" >&2
+            exit 1
+          fi
+
+          jq --exit-status '
+            .headers
+            | type == "array"
+              and length > 0
+              and length <= 1000
+              and (unique | length) == length
+              and all(.[];
+                if type == "string" then
+                  length > 0
+                    and length <= 256
+                    and test("\\A[!#$%&\u0027*+.^_`|~0-9A-Za-z-]+\\z")
+                else
+                  false
+                end
+              )
+          ' "$response_file" > /dev/null
+
+          remote_branch_sha=""
+          if git ls-remote --exit-code --heads origin "refs/heads/$UPDATE_BRANCH" > /dev/null 2>&1; then
+            git fetch \
+              --no-tags \
+              origin \
+              "+refs/heads/$UPDATE_BRANCH:refs/remotes/origin/$UPDATE_BRANCH"
+            remote_branch_sha=$(git rev-parse "refs/remotes/origin/$UPDATE_BRANCH")
+          fi
+
+          git switch \
+            --force-create "$UPDATE_BRANCH" \
+            "origin/$BASE_BRANCH"
+
+          {
+            printf 'export const removalHeaders = [\n'
+            jq --raw-output '.headers[] | "  \(tojson),"' "$response_file"
+            printf '];\n'
+          } > "$OUTPUT_PATH"
+
+          if [[ -z "$(git status --porcelain -- "$OUTPUT_PATH")" ]]; then
+            echo "Removal headers are already up to date"
+            exit 0
+          fi
+
+          printf '%s\n' \
+            '---' \
+            '"@mcansh/http-helmet": patch' \
+            '---' \
+            '' \
+            'Update the insecure response headers list from the OWASP Secure Headers Project.' \
+            > "$CHANGESET_PATH"
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add "$CHANGESET_PATH" "$OUTPUT_PATH"
+          git commit -m "chore(http-helmet): update removal headers"
+
+          if [[ -n "$remote_branch_sha" ]]; then
+            git push \
+              --force-with-lease="refs/heads/$UPDATE_BRANCH:$remote_branch_sha" \
+              origin \
+              "HEAD:refs/heads/$UPDATE_BRANCH"
+          else
+            git push \
+              --set-upstream origin \
+              "HEAD:refs/heads/$UPDATE_BRANCH"
+          fi
+
+          existing_pr=$(gh pr list \
+            --repo "$GITHUB_REPOSITORY" \
+            --base "$BASE_BRANCH" \
+            --head "$UPDATE_BRANCH" \
+            --state open \
+            --json number \
+            --jq '.[0].number // empty')
+
+          if [[ -n "$existing_pr" ]]; then
+            gh pr view "$existing_pr" \
+              --repo "$GITHUB_REPOSITORY" \
+              --json url \
+              --jq '"Updated pull request: \(.url)"'
+            exit 0
+          fi
+
+          printf -v pr_body '%s\n\n%s' \
+            'Updates `packages/http-helmet/src/removal-headers.ts` from the OWASP Secure Headers Project.' \
+            'Generated automatically by `.github/workflows/update-removal-headers.yml`.'
+
+          gh pr create \
+            --repo "$GITHUB_REPOSITORY" \
+            --base "$BASE_BRANCH" \
+            --head "$UPDATE_BRANCH" \
+            --title "chore(http-helmet): update removal headers" \
+            --body "$pr_body"

apps/http-helmet/react-router-v7/app/entry.server.tsx

@@ -2,6 +2,7 @@ import {
   createNonce,
   createSecureHeaders,
   mergeHeaders,
+  removeInsecureHeaders,
 } from "@mcansh/http-helmet";
 import { NonceProvider } from "@mcansh/http-helmet/react";
 import { createReadableStreamFromReadable } from "@react-router/node";
@@ -54,7 +55,10 @@ export default function handleRequest(
 
           resolve(
             new Response(stream, {
-              headers: mergeHeaders(responseHeaders, secureHeaders),
+              headers: mergeHeaders(
+                removeInsecureHeaders(responseHeaders),
+                secureHeaders,
+              ),
               status: responseStatusCode,
             }),
           );

packages/http-helmet/README.md

@@ -66,3 +66,20 @@ server.listen(3000);
 
 console.log("✅ app ready: http://localhost:3000");
 ```
+
+## Remove Insecure Headers
+
+`removeInsecureHeaders` returns a copy of a `Headers` object with every
+server-identifying, framework, and diagnostic header in the [OWASP Secure
+Headers Project](https://owasp.org/www-project-secure-headers/) list removed,
+leaving the original untouched.
+
+```js
+import { removeInsecureHeaders } from "@mcansh/http-helmet";
+
+let headers = removeInsecureHeaders(responseHeaders);
+```
+
+This is opt-in, so existing behavior is unchanged. Every entry in the list is
+removed — there's no per-header allowlist — so don't use it if your app relies
+on a removed header like `X-B3-*` or `X-Datadog-*` for observability.

packages/http-helmet/src/index.ts

@@ -11,6 +11,7 @@ export {
   WASM_UNSAFE_EVAL,
   createNonce,
   mergeHeaders,
+  removeInsecureHeaders,
 } from "./utils";
 
 export {

packages/http-helmet/src/removal-headers.ts

@@ -0,0 +1,89 @@
+export const removalHeaders = [
+  "$wsep",
+  "Host-Header",
+  "K-Proxy-Request",
+  "Liferay-Portal",
+  "OracleCommerceCloud-Version",
+  "Pega-Host",
+  "Powered-By",
+  "Product",
+  "Server",
+  "SourceMap",
+  "X-AspNet-Version",
+  "X-AspNetMvc-Version",
+  "X-Atmosphere-error",
+  "X-Atmosphere-first-request",
+  "X-Atmosphere-tracking-id",
+  "X-B3-ParentSpanId",
+  "X-B3-Sampled",
+  "X-B3-SpanId",
+  "X-B3-TraceId",
+  "X-BEServer",
+  "X-Backside-Transport",
+  "X-CF-Powered-By",
+  "X-CMS",
+  "X-CalculatedBETarget",
+  "X-Cocoon-Version",
+  "X-Content-Encoded-By",
+  "X-Datadog-Origin",
+  "X-Datadog-Parent-Id",
+  "X-Datadog-Sampling-Priority",
+  "X-Datadog-Tags",
+  "X-Datadog-Trace-Id",
+  "X-DiagInfo",
+  "X-Envoy-Attempt-Count",
+  "X-Envoy-External-Address",
+  "X-Envoy-Internal",
+  "X-Envoy-Original-Dst-Host",
+  "X-Envoy-Upstream-Service-Time",
+  "X-FEServer",
+  "X-Framework",
+  "X-Generated-By",
+  "X-Generator",
+  "X-Gitlab-Meta",
+  "X-Jitsi-Release",
+  "X-Joomla-Version",
+  "X-Kong-Admin-Latency",
+  "X-Kong-Client-Latency",
+  "X-Kong-Proxy-Latency",
+  "X-Kong-Request-Id",
+  "X-Kong-Response-Latency",
+  "X-Kong-Third-Party-Latency",
+  "X-Kong-Total-Latency",
+  "X-Kong-Upstream-Latency",
+  "X-Kong-Upstream-Status",
+  "X-Kubernetes-PF-FlowSchema-UI",
+  "X-Kubernetes-PF-PriorityLevel-UID",
+  "X-LiteSpeed-Cache",
+  "X-LiteSpeed-Purge",
+  "X-LiteSpeed-Tag",
+  "X-LiteSpeed-Vary",
+  "X-Litespeed-Cache-Control",
+  "X-Mod-Pagespeed",
+  "X-Nextjs-Cache",
+  "X-Nextjs-Matched-Path",
+  "X-Nextjs-Page",
+  "X-Nextjs-Redirect",
+  "X-OWA-Version",
+  "X-Old-Content-Length",
+  "X-OneAgent-JS-Injection",
+  "X-Page-Speed",
+  "X-Php-Version",
+  "X-Powered-By",
+  "X-Powered-By-Plesk",
+  "X-Powered-CMS",
+  "X-Redirect-By",
+  "X-Server-Powered-By",
+  "X-SourceFiles",
+  "X-SourceMap",
+  "X-Turbo-Charged-By",
+  "X-Tyk-Trace-Id",
+  "X-Umbraco-Version",
+  "X-Varnish-Backend",
+  "X-Varnish-Server",
+  "X-Woodpecker-Version",
+  "X-dtAgentId",
+  "X-dtHealthCheck",
+  "X-dtInjectedServlet",
+  "X-ruxit-JS-Agent",
+];

packages/http-helmet/src/utils.spec.ts

@@ -0,0 +1,47 @@
+import { describe, expect, it } from "vitest";
+import { removalHeaders } from "./removal-headers.js";
+import { removeInsecureHeaders } from "./utils.js";
+
+describe("removeInsecureHeaders", () => {
+  it("removes every configured insecure header", () => {
+    let responseHeaders = new Headers();
+
+    for (let header of removalHeaders) {
+      responseHeaders.set(header, "exposed");
+    }
+
+    let headers = removeInsecureHeaders(responseHeaders);
+    let remainingInsecureHeaders = removalHeaders.filter((header) =>
+      headers.has(header),
+    );
+
+    expect(removalHeaders.length).toBeGreaterThan(0);
+    expect(remainingInsecureHeaders).toStrictEqual([]);
+  });
+
+  it("preserves headers that are not configured for removal", () => {
+    let responseHeaders = new Headers({
+      "Cache-Control": "max-age=60",
+      "Content-Type": "text/html; charset=utf-8",
+      Server: "example",
+    });
+
+    let headers = removeInsecureHeaders(responseHeaders);
+
+    expect(headers.get("Cache-Control")).toBe("max-age=60");
+    expect(headers.get("Content-Type")).toBe("text/html; charset=utf-8");
+    expect(headers.has("Server")).toBe(false);
+  });
+
+  it("does not mutate the original headers", () => {
+    let responseHeaders = new Headers({
+      Server: "example",
+    });
+
+    let headers = removeInsecureHeaders(responseHeaders);
+
+    expect(headers).not.toBe(responseHeaders);
+    expect(headers.has("Server")).toBe(false);
+    expect(responseHeaders.get("Server")).toBe("example");
+  });
+});

packages/http-helmet/src/utils.ts

@@ -1,3 +1,5 @@
+import { removalHeaders } from "./removal-headers.js";
+
 export function isQuoted(value: string): boolean {
   return /^".*"$/.test(value);
 }
@@ -65,3 +67,13 @@ export function mergeHeaders(...sources: HeadersInit[]): Headers {
 export function createNonce(): string {
   return Buffer.from(crypto.randomUUID()).toString("base64");
 }
+
+export function removeInsecureHeaders(responseHeaders: Headers) {
+  const headers = new Headers(responseHeaders);
+
+  for (const key of removalHeaders) {
+    headers.delete(key);
+  }
+
+  return headers;
+}