# Reject Requests with Empty Host Header

**URL:** https://community.traefik.io/t/reject-requests-with-empty-host-header/14374
**Category:** Traefik v2
**Tags:** kubernetes-ingress
**Created:** [May 5, 2022, 9:49pm UTC](https://community.traefik.io/t/reject-requests-with-empty-host-header/14374 "2022-05-05T21:49:08Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![justin-spies](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/justin-spies/32/5010_2.png) [@justin-spies](https://community.traefik.io/u/justin-spies)
#### Post date: [May 5, 2022, 9:49pm UTC](https://community.traefik.io/t/reject-requests-with-empty-host-header/14374/1 "2022-05-05T21:49:09Z")

</div>

Is there a way to reject any HTTP requests, without using middleware, where the host header is not set or the host header is set to an empty string, e.g.

```auto
Host: ''

```

When using Traefik in EKS behind an AWS ELB using an Ingress, any HTTP 1.0 requests with an intentionally null host header result in the private IP of the ELB being exposed when a redirect from HTTP to HTTPS is generated. e.g. the resulting redirect looks like:

```auto
Location: https://10.1.2.3/

```

This is a medium level security risk according to the HTTP vulnerability scanning tool we're using and needs to be addressed.

---

<div class="post-metadata">

### Author: ![justin-spies](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/justin-spies/32/5010_2.png) [@justin-spies](https://community.traefik.io/u/justin-spies)
#### Post date: [May 6, 2022, 8:45pm UTC](https://community.traefik.io/t/reject-requests-with-empty-host-header/14374/2 "2022-05-06T20:45:34Z")

</div>

I found the root cause. When sending an HTTP/1.0 request to an AWS ELB with an empty host header, the ELB automatically changes the request sent to Traefik to an HTTP/1.1 request and replaces the empty host: header with the private IP of the ELB, e.g. if the ELB private IP is 10.1.2.3, then the request sent to Traefik is:

GET / HTTP/1.1  
host: 10.1.2.3  
Accept: _/_  
User-Agent: curl/1.2.3  
X-Forwarded-For: 44.1.2.3  
X-Forwarded-Port: 80  
X-Forwarded-Proto: http

---

<div class="post-metadata">

### Author: ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)
#### Post date: [May 9, 2022, 5:33pm UTC](https://community.traefik.io/t/reject-requests-with-empty-host-header/14374/3 "2022-05-09T17:33:18Z")

</div>

Thanks @justin-spies

I was trying to replicate myself but couldn't the ELB was the missing piece.

Great info for anybody looking into the same security finding.