Classic Load Balancer should be configured with defensive or strictest desync mitigation mode

How to fix it

• Can break clients: Strictest also blocks requests that break RFC 7230 but pose no known threat, so a client sending them fails; Defensive lets them through.

In the console

EC2 → Load balancers → the load balancer → Attributes → Traffic configuration

Desync mitigation mode

Defensive - recommended (AWS's default), or Strictest

With the AWS CLI

aws elb modify-load-balancer-attributes --load-balancer-name <load-balancer-name> --load-balancer-attributes AdditionalAttributes=[{Key=elb.http.desyncmitigationmode,Value=defensive}] --region <region>

With Terraform

resource "aws_elb" "this" {
  desync_mitigation_mode = "defensive"

  listener {
    lb_port           = 80
    lb_protocol       = "http"
    instance_port     = 80
    instance_protocol = "http"
  }
}