API Gateway Header Forwarding: Why Your Backend Sees the Wrong Host

The problem: API Gateway rewrites the Host header

When API Gateway forwards a request to an HTTP integration (ALB, EC2, custom HTTP endpoint), it sets the Host header to the integration URL — not the original hostname the client sent.

Client sends:
  GET /api/status HTTP/1.1
  Host: api.example.com

API Gateway forwards to ALB:
  GET /api/status HTTP/1.1
  Host: my-alb-1234567890.us-east-1.elb.amazonaws.com  ← rewritten

If your backend uses virtual hosting — different nginx server blocks for different hostnames, or application-level routing on the Host header — it sees the ALB hostname instead of api.example.com and routes incorrectly or returns 404.

How to forward the original hostname

HTTP API (recommended): in the integration settings, enable "Use HTTP proxy integration" or configure a parameter mapping to forward the original host as a custom header.

# In AWS CDK or Terraform — HTTP API with parameter mapping
integrationUri: http://${alb_dns}
parameterMapping:
  overwrite:header.x-original-host: "$request.header.host"

Your backend then reads X-Original-Host instead of Host.

REST API (integration request): use a mapping template to set a header containing the original hostname.

In the API Gateway console → Integration Request → HTTP Headers:

Name: X-Original-Host
Mapped from: method.request.header.Host

Or in Terraform:

resource "aws_api_gateway_integration" "alb_integration" {
  rest_api_id = aws_api_gateway_rest_api.api.id
  resource_id = aws_api_gateway_resource.proxy.id
  http_method = "ANY"
  type        = "HTTP_PROXY"
  uri         = "http://${aws_lb.internal.dns_name}/{proxy}"

  request_parameters = {
    "integration.request.header.X-Original-Host" = "method.request.header.Host"
  }
}

The x-forwarded-for restriction

On HTTP APIs, you cannot set or overwrite x-forwarded-for in a parameter mapping. API Gateway manages this header to track the client IP chain. Attempting to map it produces:

Invalid mapping expression specified: Validation Result: warnings : [], errors : [Operations on header x-forwarded-for are restricted]

The actual client IP is available in the forwarded header that API Gateway injects:

forwarded: for=207.81.250.185;host=api.example.com;proto=https

This header contains both the original client IP (for=) and the original hostname (host=). If your backend needs the original hostname for routing, parse it from the forwarded header rather than trying to override x-forwarded-for.

# Extract original host from API Gateway's forwarded header
def get_original_host(request):
    forwarded = request.headers.get('forwarded', '')
    for part in forwarded.split(';'):
        if part.strip().startswith('host='):
            return part.strip()[5:]
    # fallback to x-original-host if explicitly forwarded
    return request.headers.get('x-original-host', '')

The full header picture in a CloudFront → API Gateway → ALB chain

When traffic flows through CloudFront → API Gateway → ALB → ECS:

Client IP: 207.81.250.185
Client Host: api.example.com

Headers at ALB (as seen by backend):
  host:              my-alb-1234.us-east-1.elb.amazonaws.com  ← rewritten
  x-forwarded-for:   207.81.250.185, 10.0.1.70               ← client IP + API GW IP
  x-forwarded-proto: https
  x-forwarded-port:  443
  forwarded:         for=207.81.250.185;host=api.example.com;proto=https
  x-amzn-trace-id:   Self=1-abc;Root=1-def
  via:               HTTP/1.1 AmazonAPIGateway

x-forwarded-for contains the original client IP. The API Gateway's internal IP appears as a second entry. The original Host is preserved in the forwarded header.

Internet → NLB (TCP:443, no TLS termination) → ALB (HTTPS listener, terminates TLS) → ECS

# VPC link gives API Gateway access to private ALB
resource "aws_apigatewayv2_vpc_link" "main" {
  name               = "api-vpc-link"
  security_group_ids = [aws_security_group.api_gw.id]
  subnet_ids         = aws_subnet.private[*].id
}