> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# ELBs Should Drop Invalid HTTP Header

### More Info:

Invalid HTTP Headers in ELB should be dropped.

### Risk Level

Medium

### Address

Security

### Compliance Standards

HIPAA, GDPR, NIST

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Sure, I can help you with that. Here are the step-by-step instructions to remediate the misconfiguration "ELBs Should Drop Invalid HTTP Header" in AWS using the AWS console:

        1. Open the AWS Management Console and navigate to the EC2 dashboard.

        2. Click on "Load Balancers" in the left-hand menu.

        3. Select the ELB for which you want to remediate this misconfiguration.

        4. Click on the "Listeners" tab in the bottom pane.

        5. Identify the listener that is using an invalid HTTP header and click on the "Edit" button for that listener.

        6. Scroll down to the "HTTP Headers" section and click on the "Add" button.

        7. In the "Name" field, enter the name of the invalid HTTP header that you want to drop.

        8. In the "Value" field, enter the value of the invalid HTTP header that you want to drop.

        9. Click on the "Save" button to save the changes.

        10. Repeat steps 5-9 for any other listeners that are using invalid HTTP headers.

        11. Once you have remediated all the invalid HTTP headers, click on the "Save" button to save the changes to the ELB.

        That's it! You have successfully remediated the misconfiguration "ELBs Should Drop Invalid HTTP Header" in AWS using the AWS console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the "ELBs Should Drop Invalid HTTP Header" misconfiguration for AWS using AWS CLI, you can follow these steps:

        1. Open the AWS CLI and run the following command to list all the load balancers in your AWS account:

           ```
           aws elbv2 describe-load-balancers
           ```

        2. Identify the ARN (Amazon Resource Name) of the load balancer that you want to remediate.

        3. Run the following command to update the load balancer attributes and drop invalid HTTP headers:

           ```
           aws elbv2 modify-load-balancer-attributes --load-balancer-arn <load_balancer_arn> --attributes Key=http2.dropped_headers,Value=HTTP_X_FORWARDED_FOR
           ```

           Note: Replace `<load_balancer_arn>` with the ARN of the load balancer identified in step 2.

        4. Verify that the invalid HTTP headers are dropped by running the following command:

           ```
           aws elbv2 describe-load-balancer-attributes --load-balancer-arn <load_balancer_arn>
           ```

           Note: Replace `<load_balancer_arn>` with the ARN of the load balancer identified in step 2.

           This command will return the load balancer attributes, including the dropped HTTP headers.

        By following these steps, you should be able to remediate the "ELBs Should Drop Invalid HTTP Header" misconfiguration for AWS using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "ELBs Should Drop Invalid HTTP Header" for AWS using python, follow these steps:

        1. Import the boto3 library to interact with AWS services using python.

           ```python theme={null}
           import boto3
           ```

        2. Create a boto3 client for the Elastic Load Balancing service.

           ```python theme={null}
           elb_client = boto3.client('elbv2')
           ```

        3. Get a list of all the load balancers in your AWS account.

           ```python theme={null}
           response = elb_client.describe_load_balancers()
           load_balancers = response['LoadBalancers']
           ```

        4. For each load balancer, check if the "http.headers" attribute is set to "drop.invalid.header.fields". If it is not, update the attribute to "drop.invalid.header.fields".

           ```python theme={null}
           for lb in load_balancers:
               lb_arn = lb['LoadBalancerArn']
               lb_attributes = elb_client.describe_load_balancer_attributes(LoadBalancerArn=lb_arn)
               lb_http_headers = lb_attributes['Attributes'][0]
               if lb_http_headers['Key'] == 'http.headers':
                   if lb_http_headers['Value'] != 'drop.invalid.header.fields':
                       elb_client.modify_load_balancer_attributes(
                           LoadBalancerArn=lb_arn,
                           Attributes=[
                               {
                                   'Key': 'http.headers',
                                   'Value': 'drop.invalid.header.fields'
                               }
                           ]
                       )
           ```

        5. Once the "http.headers" attribute is updated for all the load balancers, the misconfiguration "ELBs Should Drop Invalid HTTP Header" will be remediated.

           ```python theme={null}
           print("Misconfiguration remediated successfully!")
           ```

        Note: Make sure you have the necessary permissions to modify the attributes of the load balancers in your AWS account.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.aws.amazon.com/elasticloadbalancing/](https://docs.aws.amazon.com/elasticloadbalancing/)