ELB.4

Application load balancer should be configured to drop http headers

Severity

Cloud Platforms

Resources

MEDIUM

AWS

Elastic Load Balancing

This control evaluates AWS Application Load Balancers (ALB) to ensure they are configured to drop http headers. By default; ALBs are not configured to drop invalid http header values. This control evaluates all ALBs fails if the attribute value of routing.http.drop_invalid_header_fields.enabled is set to false.