ALB does not drop invalid HTTP header fields

Severity: Low
Service: Elastic Load Balancing
Check ID: REQUEST_SMUGGLING

What this check finds

The load balancer forwards requests whose header names are not valid HTTP. Malformed headers are one of the ways HTTP request smuggling works against ALBs, as described here: https://portswigger.net/web-security/request-smuggling

Passing looks like: ALB drops invalid HTTP header fields.

How to fix it

Turn on 'Drop invalid header fields' for the ALB.

AWS CLI

aws elbv2 modify-load-balancer-attributes --load-balancer-arn ALB_ARN --attributes Key=routing.http.drop_invalid_header_fields.enabled,Value=true

Also consider setting HTTP desync mitigation mode to strictest.

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

EC2 → Load Balancers → select ALB → Attributes → Edit → Drop invalid header fields.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to ALB does not drop invalid HTTP header fields
Framework	Controls
SOC 2 — Trust Services Criteria	CC6.4 Network Security Controls
NIST SP 800-53 Rev5 (Moderate)	SC-7 Boundary Protection SI-10 Information Input Validation
NIST Cybersecurity Framework 2.0	PR.IR-01 Networks and environments are protected from unauthorized logical access and usage PR.PS-02 Software is maintained commensurate with risk
ISO/IEC 27001:2022 Annex A	A.8.20 Networks security A.8.26 Application security requirements

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More Elastic Load Balancing checks

All Elastic Load Balancing checks