Terraform aws lb: drop invalid header fields

• https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb#drop_invalid_header_fields

drop_invalid_header_fields (Optional) Whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type application.

Related

• alb-http-drop-invalid-header-enabled
• Datadog: Application Load Balancers should be configured to drop HTTP headers
• AWS ALB: alb.ingress.kubernetes.io/load-balancer-attributes: routing.http.drop_invalid_header_fields.enabled=true

See also

• Terraform LB: aws_lb: drop_invalid_header_fields
• HTTP Headers: Authorization:, X-Frame-Options, Content-Security-Policy, Cache-Control, Terraform: drop_invalid_header_fields
• HTTP headers, Security headers, HTTP Security headers, X-Forwarded-For (XFF)