The service can distribute incoming traffic based on application layer (OSI layer 7) information. Some of the supported protocols on layer 7 are HTTP/2, HTTP/3, HTTPS, gRPC, and WebSockets.
Layer 7 Routing
CCC.LB.CP03
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.LB.TH11 | Routing Rules Direct Requests to Unintended Destinations | Path, host or header routing rules, redirects, rewrites and fixed responses may be misordered, overly broad, or modified without authorization. Requests are then forwarded to the wrong backend, redirected to an external destination, or answered with attacker-controlled content. This exposes internal services and compromises the confidentiality and integrity of user sessions and data. |
| CCC.LB.TH12 | Application-Layer Inspection Is Absent or Bypassed | The web application firewall may not be attached to the listener, may run in detection-only mode, or may be bypassed by traffic that is passed at layer 4 or carried over an upgraded WebSocket connection. Malformed or exploit payloads then reach backend targets without inspection, compromising the integrity and availability of those targets. |
| CCC.LB.TH13 | Client Source Address Is Spoofed via Forwarded Headers | Forwarded-for headers supplied by the client may be appended to rather than replaced by the load balancer. Backend targets and downstream access rules that trust these headers then attribute requests to a false source address, allowing IP-based allowlists to be bypassed and access logs to be poisoned. This compromises the confidentiality of protected resources and the integrity of audit records. |