Application Load Balancer should be configured with defensive or strictest desync mitigation mode

How to fix it

• Can break clients: Strictest also blocks requests that break RFC 7230 but pose no known threat, so a client sending them fails; Defensive lets them through.

In the console

EC2 → Load balancers → the load balancer → Attributes → Packet handling

Desync mitigation mode

Defensive (AWS's default), or Strictest

With the AWS CLI

aws elbv2 modify-load-balancer-attributes --load-balancer-arn <load-balancer-arn> --attributes Key=routing.http.desync_mitigation_mode,Value=defensive --region <region>

With Terraform

resource "aws_lb" "this" {
  subnets                = var.subnet_ids
  desync_mitigation_mode = "defensive"
}