AWS elasticloadbalancing high security documentation change

Service: elasticloadbalancing · 2025-08-16 · Security-related high

File: elasticloadbalancing/latest/application/x-forwarded-headers.md

Summary

Added detailed documentation for X-Forwarded-For header processing modes (append/preserve/remove), including configuration examples for Console, AWS CLI, and CloudFormation.

Security assessment

The X-Forwarded-For header is explicitly called out as having potential security risks for IP spoofing. The documentation now provides explicit controls to remove or manage this header, which directly mitigates security risks associated with header manipulation. The original text warns about spoofing risks, and the new controls address this vulnerability.

Diff

diff --git a/elasticloadbalancing/latest/application/x-forwarded-headers.md b/elasticloadbalancing/latest/application/x-forwarded-headers.md
index 6d7ab9814..a5c236f4f 100644
--- a//elasticloadbalancing/latest/application/x-forwarded-headers.md
+++ b//elasticloadbalancing/latest/application/x-forwarded-headers.md
@@ -31,0 +32,11 @@ The `X-Forwarded-For` header should be used with caution due to the potential fo
+###### Processing mode
+
+  * Append
+
+  * Preserve
+
+  * Remove
+
+
+
+
@@ -79,2 +89,0 @@ The `remove` mode in the attribute removes the `X-Forwarded-For` header in the H
-###### Note
-
@@ -85 +94 @@ The following table shows examples of the `X-Forwarded-For` header that the targ
-Request description |  Example request | XFF in `append` mode  | XFF in `preserve` mode | XFF in `remove` mode  
+Request description | Example request | append | preserve | remove  
@@ -91 +100,4 @@ Request is sent with an XFF header with multiple client IP addresses. | `GET /in
-###### To modify, preserve, or remove the X-Forwarded-For header using the console
+Console
+    
+
+###### To manage the X-Forwarded-For header
@@ -101 +113 @@ Request is sent with an XFF header with multiple client IP addresses. | `GET /in
-  5. In the **Traffic configuration** section, under **Packet handling** , for **X-Forwarded-For header** choose **Append** (default), **Preserve** , or **Remove**.
+  5. In the **Traffic configuration** section, under **Packet handling** , for **X-Forwarded-For header** , choose **Append** (default), **Preserve** , or **Remove**.
@@ -108 +120,19 @@ Request is sent with an XFF header with multiple client IP addresses. | `GET /in
-###### To modify, preserve, or remove the X-Forwarded-For header using the AWS CLI
+AWS CLI
+    
+
+###### To manage the X-Forwarded-For header
+
+Use the [modify-load-balancer-attributes](https://docs.aws.amazon.com/cli/latest/reference/elbv2/modify-load-balancer-attributes.html) command with the `routing.http.xff_header_processing.mode` attribute. The possible values are `append`, `preserve`, and `remove`. The default is `append`.
+    
+    
+    aws elbv2 modify-load-balancer-attributes \
+        --load-balancer-arn load-balancer-arn \
+        --attributes "Key=routing.http.xff_header_processing.mode,Value=preserve"
+
+CloudFormation
+    
+
+###### To manage the X-Forwarded-For header
+
+Update the [AWS::ElasticLoadBalancingV2::LoadBalancer](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-loadbalancer.html) resource to include the `routing.http.xff_header_processing.mode` attribute. The possible values are `append`, `preserve`, and `remove`. The default is `append`.
+    
@@ -110 +140,15 @@ Request is sent with an XFF header with multiple client IP addresses. | `GET /in
-Use the [modify-load-balancer-attributes](https://docs.aws.amazon.com/cli/latest/reference/elbv2/modify-load-balancer-attributes.html) command with the `routing.http.xff_header_processing.mode` attribute.
+    Resources:
+      myLoadBalancer:
+        Type: AWS::ElasticLoadBalancingV2::LoadBalancer
+        Properties:
+          Name: my-alb
+          Type: application
+          Scheme: internal
+          Subnets: 
+            - !Ref subnet-AZ1
+            - !Ref subnet-AZ2
+          SecurityGroups: 
+            - !Ref mySecurityGroup
+          LoadBalancerAttributes: 
+            - Key: "routing.http.xff_header_processing.mode"
+              Value: "preserve"
@@ -138 +182 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please
-Delete a rule
+Configure user authentication
@@ -140 +184 @@ Delete a rule
-Header modification
+HTTP header modification