All checks
Medium
Application load balancer should be configured to drop invalid http headers
Verifies that Application Load Balancers remove HTTP headers whose names are not valid instead of forwarding them to targets, reducing the risk of header injection and HTTP desync. AWS calls desync mitigation mode (ELB.12) the more comprehensive protection and recommends turning this control off in accounts that check ELB.12.
- service
- ELB
- severity
- Medium
- scope
- evaluated in every region
How to fix it
- Can break clients: Headers whose names hold anything but letters, digits and hyphens, such as an underscore, are removed, so a target that reads one stops receiving it.
In the console
EC2 → Load balancers → the load balancer → Attributes
- Drop invalid header fields
- On
With the AWS CLI
aws elbv2 modify-load-balancer-attributes --load-balancer-arn <load-balancer-arn> --attributes Key=routing.http.drop_invalid_header_fields.enabled,Value=true --region <region>With Terraform
resource "aws_lb" "this" {
subnets = var.subnet_ids
drop_invalid_header_fields = true
}See which of your accounts this check is failing on.
Book a live scan