How do I add or configure headers in my Application Load Balancer responses?

Short description

To add or remove headers in your Application Load Balancer responses, use Application Load Balancer listener attributes. You can configure custom headers that aren't supported by Application Load Balancer listener attributes on your backend server, or with Amazon CloudFront.

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Add supported security headers to Application Load Balancer responses

You can use the console or AWS CLI to configure your Application Load Balancer to add predefined security headers.

To add security headers with the console, complete the following steps:

1. Open the Amazon Elastic Compute Cloud (Amazon EC2) console.
2. On the navigation pane, under Load Balancing, choose Load Balancers.
3. Select your Application Load Balancer.
4. On the Listeners and rules tab, select your listener.
5. From Manage listener, choose View listener details.
6. On the Attributes tab, in the Attributes section, choose Edit.
7. In the Add response headers section, turn on the header that you want to add to responses, and then specify the value of the header.
   Note: Security header options include HTTP Strict Transport Security (HSTS), Cross-Origin Resource Sharing (CORS), and Content Security Policy (CSP).

To add security headers with the AWS CLI, run the following modify-listener-attributes command:

aws elbv2 modify-listener-attributes --listener-arn listener-arn-value --attributes Key=attribute-key,Value="attribute-value"

Note: Replace listener-arn-value with your listener Amazon Resource Name (ARN), attribute-key with your key, and attribute-value with your attribute value.

Note that if the HTTP response from your target has a header that you already configured, then the Application Load Balancer overwrites it with the new value.

For more information about supported headers, see Add response headers.

Remove the server header from Application Load Balancer responses

If the Application Load Balancer generates HTTP responses, then the Application Load Balancer adds a server:awselb/2.0 header to responses. The Application Load Balancer also adds this header if the response from the target doesn't include a server header. To limit information disclosure, it's a best practice to remove these headers.

To remove the server:awselb/2.0 header, complete the following steps:

1. Open the Amazon EC2 console.
2. On the navigation pane, under Load Balancing, choose Load Balancers.
3. Select your Application Load Balancer.
4. On the Listeners and rules tab, select your listener.
5. From Manage listener, choose View listener details.
6. On the Attributes tab, in the Attributes section, choose Edit.
7. In the ALB server response header section, turn off Server header.

To remove this server header with the AWS CLI, run the following modify-listener-attributes command:

aws elbv2 modify-listener-attributes --listener-arn listener-arn-value --attributes Key=routing.http.response.server.enabled,Value=false 

Note: Replace listener-arn-value with your listener ARN.

Note: If the HTTP response from the target for your Application Load Balancer already includes a server header, the Application Load Balancer doesn't modify or remove it. This setting removes only the server:awselb/2.0 header that the Application Load Balancer itself adds.

Configure custom headers

Application Load Balancer provides a predefined set of response headers. If you need to configure headers Application Load Balancer doesn't provide, then you can add headers on a backend server or use Amazon CloudFront.

To add headers on a backend server, configure your backend server to include the required headers in responses. The Application Load Balancer then forwards the headers to clients. To forward the header, take one of the following actions based on your client:

• With NGINX, use the add_header directive. See add_header directive on the NGINX website.
• With Apache, use the Header directive. See Header Directive on the Apache website.

To add headers with the CloudFront console, place a CloudFront distribution in front of your Application Load Balancer. Then, add a response headers policy to configure custom headers.