ALB does not drop HTTP headers misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_131
Category - Subcategory	Public Exposure - Load Balancing
Provider	AWS
Severity	MEDIUM
Framework	CloudFormation, Serverless, Terraform, Terraform Plan

Impact

This rule ensures that Application Load Balancers (ALBs) are configured to drop HTTP headers that do not conform to RFC specifications. This improves security by preventing header injection attacks and other potential misuse of faulty headers.

How to Fix

To mitigate this issue, ensure the LoadBalancerAttributes parameter in the AWS::ElasticLoadBalancingV2::LoadBalancer resource includes the attribute routing.http.drop_invalid_header_fields.enabled set to true.

Example: [source,go]

{ "Resources": { "MyLoadBalancer": { "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer", "Properties": { ... "Type": "application", "LoadBalancerAttributes": [ { "Key": "routing.http.drop_invalid_header_fields.enabled", "Value": "true" } ] } } } }

Resources: MyLoadBalancer: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: ... Type: application LoadBalancerAttributes:

• Key: routing.http.drop_invalid_header_fields.enabled Value: "true"

---