Application Load Balancer should be configured with defensive or strictest desync mitigation mode

How to fix it

Set routing.http.desync_mitigation_mode to defensive or strictest on the Application Load Balancer. Monitor mode forwards malformed requests and only counts them, which is why it fails. Defensive is AWS's default; strictest blocks everything that does not comply with RFC 7230 and can break a client that sends technically malformed requests.

In the console

EC2 -> Load balancers -> the load balancer -> Attributes -> Desync mitigation mode

With the AWS CLI

aws elbv2 modify-load-balancer-attributes --load-balancer-arn <load-balancer-arn> --attributes Key=routing.http.desync_mitigation_mode,Value=defensive --region <region>

With Terraform

resource "aws_lb" "this" {
  subnets                = var.subnet_ids
  desync_mitigation_mode = "defensive"
}