Add X-Powered-By header.

[arunoda]

See:

sh-3.2$ curl -v http://localhost:3000
* Rebuilt URL to: http://localhost:3000/
*   Trying ::1...
* Connected to localhost (::1) port 3000 (#0)
> GET / HTTP/1.1
> Host: localhost:3000
> User-Agent: curl/7.49.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Content-Type: text/html
< Content-Length: 3172
-------------------------------
< X-Powered-By: Next.js 1.2.3
-------------------------------
< Date: Sat, 17 Dec 2016 11:38:52 GMT
< Connection: keep-alive

[coveralls]

Coverage increased (+0.01%) to 57.143% when pulling 948c348 on arunoda:x-powered-by into b62a0e8 on zeit:master.

[STRML]

This feels like a bad idea - in general you don't want to leak information about the server in any production app - the framework name is bad enough, the exact version is worse because it makes it that much easier to target exploits.

[sedubois]

could use pkg.name to DRY

[arunoda]

But it only says next. Not Next.js.

[jamo]

Yeah, +1 for obfuscating the version. Tho if the page downloads next.js/<version>/next.min.js it's pretty obvious which version and framework is being used...

[arunoda]

Securing apps via obfuscating is a good start but it doesn't hold any good hacker to do his/her thing. (If there's an issue).

This is something Express does all the times.

What they have a way to turn it off. I'll think about something like that.

[rauchg]

All major web servers do this.
It allows us to in the future actually responsibly disclose security problems!
That said, @arunoda it'd be helpful to introduce a config flag poweredByHeader: false to turn it off

[arunoda]

@rauchg That's a good suggestion.
I'll hold this PR and do it once we've land #222

[arunoda]

@rauchg check now.
We could disable setting the header.
Additionally, we could access the config via app.config if the user uses #310

[coveralls]

Coverage decreased (-0.06%) to 57.422% when pulling ce5605c on arunoda:x-powered-by into 5ab7463 on zeit:master.

[rauchg]

And a test would be nice to add as well!

[arunoda]

@rauchg added some test cases.

[coveralls]

Coverage increased (+3.2%) to 60.635% when pulling e2cb912 on arunoda:x-powered-by into 5ab7463 on zeit:master.