kodeart / koded

src/Middleware/XPoweredByMiddleware.php

<?php

namespace Koded\Framework\Middleware;

use Psr\Http\Message\{ResponseInterface, ServerRequestInterface};
use Psr\Http\Server\{MiddlewareInterface, RequestHandlerInterface};

class XPoweredByMiddleware implements MiddlewareInterface
{
    public function __construct(private string|null $value = null)
    {
        @header_remove('x-powered-by');

It seems like you do not handle an error condition for header_remove(). This can introduce security issues, and is generally not recommended.

Are you sure the usage of header_remove('x-powered-by') is correct as it seems to always return null.

    }

    public function process(
        ServerRequestInterface $request,
        RequestHandlerInterface $handler): ResponseInterface
    {
        $response = $handler->handle($request);
        if (null === $this->value) {
            return $response;
        }
        return $response->withHeader('x-powered-by', $this->value);

The expression return $response->withHeader('x-powered-by', $this->value) returns the type Psr\Http\Message\MessageInterface which includes types incompatible with the type-hinted return Psr\Http\Message\ResponseInterface.

    }
}