title: Express.js - Helmet.js and other middleware, and mounted applications?
body: <p>In a recent learning project, I'm using three Express.js applications to separate the project into more manageable pieces.</p>
  
  <p>One application is the "primary" app, the one that listens for connections. The other two are mounted at specific routes on the primary app.</p>
  
  <p>Is it sufficient to call <code>app.disable('x-powered-by');</code> on the primary app to disable the X-Powered-By header, or would this need to be done in each of the mounted apps as well?</p>
  
  <p>Similarly, I'm looking into using Helmet.js to try and add a bit of additional security to the entire project. Is it enough to include any middleware from Helmet.js on the primary app, or would these also need to be defined in the mounted apps?</p>
  
  <p>I don't feel as though I understand how some settings and middleware affect mounted Express.js apps, and would appreciate further explanation from anyone with more experience.</p>
  
  <p><strong>Edit:</strong> After playing with <code>app.disable('x-powered-by')</code> and examining responses from the server, the X-Powered-By header appears if I don't disable it in both the primary application instance and any mounted application instances. I therefore presume Helmet.js middleware operate the same way, but I'm not 100% certain. Can anyone confirm if this is the expected behavior?</p>