Skip to main content

Remediation

Configure HTTP Desync Mitigation Mode​

Update the HTTP desync mitigation mode to defensive or strictest to prevent malformed or ambiguous HTTP requests from reaching backend targets. This helps protect applications from HTTP Request Smuggling–related attacks.

Recommendation: For most environments, the default defensive mode provides strong protection while maintaining application availability. Choose strictest for maximum security, but validate that your application can function with RFC-strict traffic, as it blocks all "Acceptable" and "Ambiguous" requests

From Command Line​

For Application Load Balancers​

Run the following command to set the desync mitigation mode to defensive (recommended for most environments):

aws elbv2 modify-load-balancer-attributes \
    --load-balancer-arn {{load-balancer-arn}} \
    --attributes Key=routing.http.desync_mitigation_mode,Value=defensive

To enforce the highest level of protection, you may optionally use strictest instead of defensive after validating application compatibility.

For Classic Load Balancers​

Run the following command to update the desync mitigation mode for a Classic Load Balancer:

aws elb modify-load-balancer-attributes \
    --load-balancer-name {{load-balancer-name}} \
    --load-balancer-attributes '{
        "AdditionalAttributes": [
            {
                "Key": "elb.http.desyncmitigationmode",
                "Value": "defensive"
            }
        ]
    }'