# Ensure Application Load Balancer is configured with defensive or strictest desync mitigation mode

- Source: https://support.icompaas.com/support/solutions/articles/62000229560-ensure-application-load-balancer-is-configured-with-defensive-or-strictest-desync-mitigation-mode
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [Policy Updates](https://support.icompaas.com/support/solutions/folders/62000168784)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**  
Desync mitigation mode protects your application from issues due to HTTP desync. HTTP desync is a vulnerability that can allow attackers to inject malicious content into your application. By configuring your Application Load Balancer (ALB) with defensive or strictest desync mitigation mode, you can help to protect your application from this vulnerability.

**Rationale:**  
HTTP desync is a serious vulnerability that can allow attackers to inject malicious content into your application. This malicious content could then be used to steal sensitive data, execute arbitrary code, or disrupt your application. By configuring your ALB with defensive or strictest desync mitigation mode, you can help to protect your application from this vulnerability.

**Impact:**  
If you do not configure your ALB with defensive or strictest desync mitigation mode, your application may be vulnerable to HTTP desync attacks. This could lead to the theft of sensitive data, the execution of arbitrary code, or the disruption of your application.

**Default Value:**  
The default desync mitigation mode for ALBs is defensive. This means that the ALB will allow safe requests, but will mitigate requests that are considered to be risky. The strictest desync mitigation mode will only allow requests that are RFC 7230 compliant.

**Pre-requisites:**

-   You must have access to the AWS Management Console or the AWS CLI.
-   You must know the name of the ALB that you want to configure.

  

**Remediation Steps:**  
To configure your ALB with defensive or strictest desync mitigation mode, you can follow these steps:

1.  Log in to the AWS Management Console.
2.  Go to the **Load Balancing** service.
3.  Select the ALB that you want to configure.
4.  Click the **Attributes** tab.
5.  Under **Packet handling**, select the **Desync mitigation mode** option.
6.  Select **Defensive** or **Strictest**.
7.  Click **Save changes**.

  

**Test Plan:**  
To test the configuration, you can send a request to your ALB and check the response. If the request is successful, then the desync mitigation mode has been configured correctly.

**Implementation Plan:**  
The implementation plan for this policy is as follows:

-   The policy will be implemented by the AWS Security team.
-   The policy will be implemented in the next quarterly security patch release.
-   The policy will be communicated to all affected users in advance of the implementation date.

**AWS CLI Process:**  
To configure desync mitigation mode using the AWS CLI, you would use the following command:

aws elb modify-load-balancer-attributes --load-balancer-name my-alb --desync-mitigation-mode defensive

  
**Using AWS GUI:**  
To configure desync mitigation mode using the AWS GUI, you would follow these steps:

1.  Log in to the AWS Management Console.
2.  Go to the **Load Balancing** service.
3.  Select the ALB that you want to configure.
4.  Click the **Attributes** tab.
5.  Under **Packet handling**, select the **Desync mitigation mode** option.
6.  Select **Defensive** or **Strictest**.
7.  Click **Save changes**.

**Backout Plan:**  
If the desync mitigation mode configuration is not successful, you can roll back the changes by following these steps:

1.  Log in to the AWS Management Console.
2.  Go to the **Load Balancing** service.
3.  Select the ALB that you want to configure.
4.  Click the **Attributes** tab.
5.  Under **Packet handling**, select the **Desync mitigation mode** option.
6.  Select **Monitor**.
7.  Click **Save changes**.

**Note:**

-   This policy is only applicable to Application Load Balancers.
-   The default desync mitigation mode for Classic Load Balancers is monitor.

**Reference:**  
[https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/config-desync-mitigation-mode.html](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/config-desync-mitigation-mode.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.