Back to Checks
aws

Application Load Balancer should be configured to drop invalid HTTP header fields

elbv2_alb_drop_invalid_header_fields_enabled
Service: elbv2Severity: medium
OfficialBuilt-inVerified
Resource Type:AwsElbv2LoadBalancer

Ensure that Application Load Balancers (ALB) are configured to drop invalid HTTP header fields. The check fails when routing.http.drop_invalid_header_fields.enabled is not set to true. By default, ALBs do not remove HTTP headers that do not conform to RFC 7230.

Prowler logoProwlerprowler-provider-aws

Risk

Forwarding non-RFC-compliant HTTP headers to backend targets enables HTTP desync (request smuggling):

  • Confidentiality: session/token theft, data exfiltration
  • Integrity: cache poisoning, request routing bypass, unauthorized actions
  • Availability: backend exhaustion. Dropping invalid header fields removes a primary smuggling vector.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elbv2_alb_drop_invalid_header_fields_enabled

Recommendation

Enable 'drop invalid header fields' on Application Load Balancers so non-RFC-compliant HTTP headers are removed before requests reach backend targets, reducing exposure to HTTP desync and request smuggling. Apply defense in depth and validate requests at the application layer as well.

Remediation

CLI

aws elbv2 modify-load-balancer-attributes --load-balancer-arn <ALB_ARN> --attributes Key=routing.http.drop_invalid_header_fields.enabled,Value=true

Terraform

# Terraform: enable drop invalid header fields on an ALB
resource "aws_lb" "<example_resource_name>" {
  name                       = "<example_resource_name>"
  load_balancer_type         = "application"
  subnets                    = ["<example_subnet_id1>", "<example_subnet_id2>"]
  drop_invalid_header_fields = true # Critical: drop non-RFC-compliant headers
}

NativeIaC

# CloudFormation: enable drop invalid header fields on an ALB
Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Type: application
      Subnets:
        - <example_subnet_id1>
        - <example_subnet_id2>
      LoadBalancerAttributes:
        - Key: routing.http.drop_invalid_header_fields.enabled  # Critical: drop non-RFC-compliant headers
          Value: true

Other

1Open the Amazon EC2 console and choose Load Balancers.
2Select the Application Load Balancer.
3On the Attributes tab, choose Edit.
4Set 'Drop invalid header fields' to Enabled.
5Save changes.

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elbv2.elbv2_client import elbv2_client


class elbv2_alb_drop_invalid_header_fields_enabled(Check):
    def execute(self):
        findings = []
        for lb in elbv2_client.loadbalancersv2.values():
            if lb.type == "application":
                report = Check_Report_AWS(
                    metadata=self.metadata(),
                    resource=lb,
                )
                report.status = "PASS"
                report.status_extended = (
                    f"ELBv2 ALB {lb.name} is configured to drop invalid "
                    "header fields."
                )
                if lb.drop_invalid_header_fields != "true":
                    report.status = "FAIL"
                    report.status_extended = (
                        f"ELBv2 ALB {lb.name} is not configured to drop "
                        "invalid header fields."
                    )
                findings.append(report)

        return findings

References