Back to Checks
aws

Application Load Balancer has desync mitigation mode set to strictest or defensive, or drops invalid header fields

elbv2_desync_mitigation_mode
Service: elbv2Severity: medium
OfficialBuilt-inVerified
Resource Type:AwsElbv2LoadBalancer

Application Load Balancer settings are reviewed for HTTP desync protections. It evaluates routing.http.desync_mitigation_mode for strictest or defensive; when neither is configured, it checks routing.http.drop_invalid_header_fields.enabled is true as a compensating control.

Prowler logoProwlerprowler-provider-aws

Risk

Lacking robust desync mitigation enables inconsistent HTTP parsing and request smuggling:

  • Confidentiality: token theft, data exfiltration
  • Integrity: cache/queue poisoning, unauthorized actions
  • Availability: backend exhaustion and outages

Only dropping invalid headers reduces but does not eliminate this exposure.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elbv2_desync_mitigation_mode

Recommendation

Set ALBs to desync_mitigation_mode=strictest (or defensive if compatibility is required) and keep routing.http.drop_invalid_header_fields.enabled=true.

Apply defense in depth: validate RFC-compliant requests, roll out changes gradually with monitoring, and enforce least privilege on downstream services.

Remediation

CLI

aws elbv2 modify-load-balancer-attributes --load-balancer-arn <ALB_ARN> --attributes Key=routing.http.desync_mitigation_mode,Value=strictest

Terraform

# Terraform: Set ALB desync mitigation mode
resource "aws_lb" "<example_resource_name>" {
  name    = "<example_resource_name>"
  subnets = ["<example_subnet_id1>", "<example_subnet_id2>"]

  desync_mitigation_mode = "strictest" # Critical: enforce strictest/defensive desync mitigation to pass the check
}

NativeIaC

# CloudFormation: Set ALB desync mitigation mode
Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Type: application
      Subnets:
        - <example_subnet_id1>
        - <example_subnet_id2>
      LoadBalancerAttributes:
        - Key: routing.http.desync_mitigation_mode  # Critical: enforce strictest/defensive desync mitigation to pass the check
          Value: strictest

Other

1Open the AWS Console and go to EC2 > Load Balancers
2Select your Application Load Balancer
3Choose Actions > Edit attributes (or the Attributes tab > Edit)
4Set Desync mitigation mode to Strictest (or Defensive)
5Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elbv2.elbv2_client import elbv2_client


class elbv2_desync_mitigation_mode(Check):
    def execute(self):
        findings = []
        for lb in elbv2_client.loadbalancersv2.values():
            if lb.type == "application":
                report = Check_Report_AWS(metadata=self.metadata(), resource=lb)
                report.status = "PASS"
                report.status_extended = f"ELBv2 ALB {lb.name} is configured with correct desync mitigation mode."
                if (
                    lb.desync_mitigation_mode != "strictest"
                    and lb.desync_mitigation_mode != "defensive"
                ):
                    if lb.drop_invalid_header_fields == "false":
                        report.status = "FAIL"
                        report.status_extended = f"ELBv2 ALB {lb.name} does not have desync mitigation mode set as strictest/defensive and is not dropping invalid header fields."
                    elif lb.drop_invalid_header_fields == "true":
                        report.status_extended = f"ELBv2 ALB {lb.name} does not have desync mitigation mode set as strictest/defensive but is dropping invalid header fields."
                findings.append(report)

        return findings

References