All checks
Medium
Application load balancer should be configured to drop invalid http headers
Verifies that Application Load Balancers remove HTTP headers whose names are not valid instead of forwarding them to targets, reducing the risk of header injection and HTTP desync. AWS calls desync mitigation mode (ELB.12) the more comprehensive protection and recommends turning this control off in accounts that check ELB.12.
- service
- ELB
- severity
- Medium
- scope
- evaluated in every region
How to fix it
In the console
EC2 → Load balancers → the load balancer → Attributes
With the AWS CLI
aws elbv2 modify-load-balancer-attributes --load-balancer-arn <load-balancer-arn> --attributes Key=routing.http.drop_invalid_header_fields.enabled,Value=true --region <region>With Terraform
resource "aws_lb" "this" {
subnets = var.subnet_ids
drop_invalid_header_fields = true
}See which of your accounts this check is failing on.
Book a demo