feat(rest): allow express settings to be customized

docs/site/Server.md

@@ -211,6 +211,25 @@ export async function main() {
 For a complete list of CORS options, see
 https://github.com/expressjs/cors#configuration-options.
 
+### Express settings
+
+Override the default express settings and/or assign your own settings:
+
+```ts
+const app = new RestApplication({
+  rest: {
+    expressSettings: {
+      'x-powered-by': false,
+      env: 'production',
+      ...
+    },
+  },
+});
+```
+
+Checkout `express` [documentation](http://expressjs.com/fr/api.html#app.set) for
+more details about the build-in settings.
+
 ### Configure the Base Path
 
 Sometime it's desirable to expose REST endpoints using a base path, such as

packages/rest/src/__tests__/unit/rest.server/rest.server.unit.ts

@@ -3,12 +3,18 @@
 // This file is licensed under the MIT License.
 // License text available at https://opensource.org/licenses/MIT
 
-import {expect} from '@loopback/testlab';
-import {anOperationSpec} from '@loopback/openapi-spec-builder';
 import {Binding, Context} from '@loopback/context';
 import {Application} from '@loopback/core';
-import {RestServer, Route, RestBindings, RestComponent} from '../../..';
-import {RequestBodyParserOptions} from '../../../types';
+import {anOperationSpec} from '@loopback/openapi-spec-builder';
+import {expect} from '@loopback/testlab';
+import {
+  RequestBodyParserOptions,
+  RestBindings,
+  RestComponent,
+  RestServer,
+  RestServerConfig,
+  Route,
+} from '../../..';
 
 describe('RestServer', () => {
   describe('"bindElement" binding', () => {
@@ -136,6 +142,33 @@ describe('RestServer', () => {
         parserOptions,
       );
     });
+
+    it('assigns express settings', () => {
+      class TestRestServer extends RestServer {
+        constructor(application: Application, config: RestServerConfig) {
+          super(application, config);
+          this._setupRequestHandlerIfNeeded();
+        }
+
+        get expressApp() {
+          return this._expressApp;
+        }
+      }
+
+      const app = new Application();
+      const server = new TestRestServer(app, {
+        expressSettings: {
+          'x-powered-by': false,
+          env: 'production',
+        },
+      });
+      const expressApp = server.expressApp;
+      expect(expressApp.get('x-powered-by')).to.equal(false);
+      expect(expressApp.get('env')).to.equal('production');
+      // `extended` is the default setting by Express
+      expect(expressApp.get('query parser')).to.equal('extended');
+      expect(expressApp.get('not set')).to.equal(undefined);
+    });
   });
 
   async function givenRequestContext() {

packages/rest/src/rest.server.ts

@@ -210,7 +210,7 @@ export class RestServer extends Context implements Server, HttpServerLike {
   protected _setupRequestHandlerIfNeeded() {
     if (this._expressApp) return;
     this._expressApp = express();
-    this._expressApp.set('query parser', 'extended');
+    this._applyExpressSettings();
     this._requestHandler = this._expressApp;
 
     // Allow CORS support for all endpoints so that users
@@ -241,6 +241,16 @@ export class RestServer extends Context implements Server, HttpServerLike {
     );
   }
 
+  /**
+   * Apply express settings.
+   */
+  protected _applyExpressSettings() {
+    const settings = this.config.expressSettings || {};
+    for (const key in settings) {
+      this._expressApp.set(key, settings[key]);
+    }
+  }
+
   /**
    * Mount /openapi.json, /openapi.yaml for specs and /swagger-ui, /explorer
    * to redirect to externally hosted API explorer
@@ -945,6 +955,8 @@ export interface RestServerOptions {
   apiExplorer?: ApiExplorerOptions;
   requestBodyParser?: RequestBodyParserOptions;
   sequence?: Constructor<SequenceHandler>;
+  // tslint:disable-next-line:no-any
+  expressSettings?: {[name: string]: any};
 }
 
 /**