(aws-elasticloadbalancingv2): dropInvalidHeaderFields not reflected in CloudFormation when set from true to false

[rgoltz]

Describe the bug

When changing the dropInvalidHeaderFields property of an Application Load Balancer (ALB) from true to false in AWS CDK (e.g. I'd like to do a rollback of the setting) , the property is not included in the resulting CloudFormation template. This is because dropInvalidHeaderFields has a default value of false. As a result, the property is omitted from the template when explicitly set to false, and the ALB configuration is not updated accordingly during a stack update.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Library Version

No response

Expected Behavior

When the dropInvalidHeaderFields property is explicitly set to false in the CDK code, it should appear in the CloudFormation template (as routing.http.drop_invalid_header_fields.enabled), regardless of its default value. This ensures that CloudFormation detects the property and performs the necessary update to the ALB configuration when the stack is updated.

Current Behavior

When changing the dropInvalidHeaderFields property from true to false in the CDK code, it is omitted from the CloudFormation template. As a result:

• The change from true to false is not applied to the ALB (property routing.http.drop_invalid_header_fields.enabled).
• During a stack update, CloudFormation does not recognize the change, and the ALB configuration remains unchanged because the property is omitted from the template.

Reproduction Steps

1. Create a new cdk init app --language=typescript CDK project.
2. Create/Update the bin-file, like this:

#!/usr/bin/env node
import * as cdk from 'aws-cdk-lib';
import { RogoAlbTestStack } from '../lib/rogo-alb-test-stack';

const app = new cdk.App();

new RogoAlbTestStack(app, 'RogoAlbTestStack', {
  env: {
    region: 'eu-central-1', 
    account: '1234567890' // change here your aws account id.
  }
});

3. Create the lib-file, which is simple ALB and set dropInvalidHeaderFields to true. Run cdk synth and check the CloudFormation output:

import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import { ApplicationLoadBalancer } from 'aws-cdk-lib/aws-elasticloadbalancingv2'; 
import { Vpc } from 'aws-cdk-lib/aws-ec2'; 

export class RogoAlbTestStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const vpc = Vpc.fromLookup(this, 'MyExistingVpc', {
      vpcId: 'vpc-0i1l2i3k4e5c6f7n8' // change here you vpc-id.
    });

    const loadBalancer = new ApplicationLoadBalancer(this, 'MyALB', {
      vpc,
      internetFacing: false,
      dropInvalidHeaderFields: true, // <--- 
    });
  }
}

$ cdk synth
Resources:
  MyALB911A8556:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      LoadBalancerAttributes:
        - Key: deletion_protection.enabled
          Value: "false"
        - Key: routing.http.drop_invalid_header_fields.enabled
          Value: "true"
# dropInvalidHeaderFields=true ==> routing.http.drop_invalid_header_fields.enabled
      Scheme: internal
...

3. Imagine we've now deployed the ALB. Now we want to roll back the setting, so we set it to false. Update the lib-file:

import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import { ApplicationLoadBalancer } from 'aws-cdk-lib/aws-elasticloadbalancingv2'; 
import { Vpc } from 'aws-cdk-lib/aws-ec2'; 

export class RogoAlbTestStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const vpc = Vpc.fromLookup(this, 'MyExistingVpc', {
      vpcId: 'vpc-0i1l2i3k4e5c6f7n8' // change here you vpc-id.
    });

    const loadBalancer = new ApplicationLoadBalancer(this, 'MyALB', {
      vpc,
      internetFacing: false,
      dropInvalidHeaderFields: false, // <--- we switch from true to false
    });
  }
}

Resources:
  MyALB911A8556:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      LoadBalancerAttributes:
        - Key: deletion_protection.enabled
          Value: "false"
# routing.http.drop_invalid_header_fields.enabled is missing, even though we define it as false in CDK.
      Scheme: internal
...

4. If we now deploy the stack again, we would expect the setting to be rolled back, but the ALB will not be updated.

Possible Solution

No response

Additional Information/Context

No response

AWS CDK Library version (aws-cdk-lib)

2.1034.0

AWS CDK CLI version

2.32.16

Node.js Version

v24.12.0

OS

Linux/Fedora Workstation

Language

TypeScript

Language Version

No response

Other information

No response

[pahud]

Hi @rgoltz,

Thank you for reporting this issue with detailed reproduction steps!

This appears to be a duplicate of #31609, which reported the same behavior for the http2Enabled property. The root cause is identical - when a boolean ALB attribute is set to its default value, CDK omits it from the CloudFormation template. However, CloudFormation does not reset attributes to their defaults when they are removed from the template, so the previously set value persists.

Issue #31609 was fixed by PR #31675, but unfortunately that fix only addressed http2Enabled and did not apply the same pattern to dropInvalidHeaderFields.

Root Cause:
The current code in application-load-balancer.ts only sets the attribute when true:

if (props.dropInvalidHeaderFields) { 
  this.setAttribute('routing.http.drop_invalid_header_fields.enabled', 'true'); 
}

Proposed Fix:
The fix should follow the same pattern as #31675:

if (props.dropInvalidHeaderFields !== undefined) { 
  this.setAttribute('routing.http.drop_invalid_header_fields.enabled', 
    props.dropInvalidHeaderFields ? 'true' : 'false'); 
}

Workaround:
Until this is fixed, you can use the escape hatch:

const cfnLb = alb.node.defaultChild as elbv2.CfnLoadBalancer;
cfnLb.addPropertyOverride('LoadBalancerAttributes.1.Key', 
  'routing.http.drop_invalid_header_fields.enabled');
cfnLb.addPropertyOverride('LoadBalancerAttributes.1.Value', 'false');

This is a small effort fix. We welcome a PR from the community to address this! 🙏

[rgoltz]

Hej @pahud - Thanks a lot for your input, review and the super helpful reference (which covering the same pattern in ALB props) - I went ahead and created (my first) PR: #36483 - Please feel free to adjust as needed. :-)