- Newest
- Most votes
- Most comments
Hi, may I know will there be any future enhancements to allow underscores in ALB ?
Hi there,
I understand that you want to know if there a way to override the "Drop Invalid header fields" ALB attribute to allow headers containing Underscore in them.
Unfortunately, there is no current ability for the ALB to consider underscore character as valid, and thus no option will be able to override this attribute if routing.http.drop_invalid_header_fields.enabled is set to true.
Although there is a workaround which will allow you to pass the headers with underscores.
You can set routing.http.drop_invalid_header_fields.enabled to false and ensure routing.http.desync_mitigation_mode is in DEFENSIVE mode.
The only limitation here is that, it allows invalid headers to pass, while desync_mitigation_mode ensures desync suspected requests doesn't share connection.
Desync mitigation is invented by ELB and goal is to protect weak target servers and underscore character is one of them that leads to confusion to some target servers that we protect.
Kind Regards,
Ahmad
It is unlikely ELB will ever allow an underscore as a valid HTTP header name or in desync mitigation mode's enforcing states. This is because it's the most common desync attack vector, specifically with the HTTP header 'Content-Length' and its incorrect version 'Content_Length'. Anyone, or any application, that considers 'Content_Length' as possible substitute for 'Content-Length' has a security vulnerability in their application and should update it to only consider the real header 'Content-Length'.