# Recommended health check strategy is impossible using AWS load balancer

**URL:** <https://community.apollographql.com/t/recommended-health-check-strategy-is-impossible-using-aws-load-balancer/6323>\
**Category:** Server\
**Tags:** server, tooling\
**Created:** [May 31, 2023, 4:06pm UTC](https://community.apollographql.com/t/recommended-health-check-strategy-is-impossible-using-aws-load-balancer/6323 "2023-05-31T16:06:51Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eric\_Dauenhauer](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/eric_dauenhauer/32/4327_2.png) [@Eric\_Dauenhauer](https://community.apollographql.com/u/Eric_Dauenhauer)\
**Post date:** [May 31, 2023, 4:06pm UTC](https://community.apollographql.com/t/recommended-health-check-strategy-is-impossible-using-aws-load-balancer/6323/1 "2023-05-31T16:06:51Z")

</div>

Apollo recommends enabling CSRF (solid recommendation ✅)

Apollo [recommends making a GET query to perform a health check against the Apollo server, not just the underlying (e.g. Express) server](https://www.apollographql.com/docs/apollo-server/monitoring/health-checks/) (also a solid recommendation ✅)

In order to make a GET query for the health check, you must include headers. The docs are explicit:

> Sending an `apollo-require-preflight: true` header alongside your health check ensures that Apollo Server’s CSRF prevention feature won’t block it.

A common way of configuring a health check (at least in AWS) is a load balancer health check. The [AWS Load Balancer health check does not support configuring headers in the request](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/target-group-health-checks.html). Therefore, using Apollo’s recommended health check strategy is impossible.

Is there any workaround for this? Is this a known issue? Does this deserve a bug report?

Thanks.

---

<div class="post-metadata">

**Author:** ![Sachin\_Deshpande](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/sachin_deshpande/32/4562_2.png) [@Sachin\_Deshpande](https://community.apollographql.com/u/Sachin_Deshpande)\
**Post date:** [September 1, 2023, 12:12pm UTC](https://community.apollographql.com/t/recommended-health-check-strategy-is-impossible-using-aws-load-balancer/6323/2 "2023-09-01T12:12:21Z")

</div>

Spot on Eric. We are stuck with the same thing.

Have you managed to find a workaround?

---

<div class="post-metadata">

**Author:** ![scott](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/scott/32/4563_2.png) [@scott](https://community.apollographql.com/u/scott)\
**Post date:** [September 4, 2023, 5:00pm UTC](https://community.apollographql.com/t/recommended-health-check-strategy-is-impossible-using-aws-load-balancer/6323/3 "2023-09-04T17:00:01Z")

</div>

+1 to you both. Having the same issue. My temporary fix was to turn off CSRF protection. I think a bug report might make sense for health checks that can’t have headers in the request. Maybe it’s just a documentation improvement (on how to implement a health check that tests that the GraphQL parts are working.

I can create an issue if the two of you haven’t figured out another way around this.

---

<div class="post-metadata">

**Author:** ![scott](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/scott/32/4563_2.png) [@scott](https://community.apollographql.com/u/scott)\
**Post date:** [September 4, 2023, 5:58pm UTC](https://community.apollographql.com/t/recommended-health-check-strategy-is-impossible-using-aws-load-balancer/6323/4 "2023-09-04T17:58:27Z")

</div>

Actually, I ended up creating a quick health check endpoint of my own just now that worked and is aligned with the health check that Apollo proposes.

```auto
    app.get('/check-health', (_req, res) => {
      server
        .executeOperation({ query: '{ __typename }' })
        .then((data) => {
          if (data.body.kind === 'single') {
            if (data.body.singleResult.errors) {
              res.status(400).send(JSON.stringify(data.body.singleResult.errors));
            } else {
              res.status(200).send(JSON.stringify(data.body.singleResult.data));
            }
          }
        })
        .catch((error) => {
          res.status(400).send(JSON.stringify(error));
        });
    });

```

I turned CSRF protection back on, pointed the load balancer to my new endpoint, and everything seems good.

---

<div class="post-metadata">

**Author:** ![TiE23](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/tie23/32/4689_2.png) [@TiE23](https://community.apollographql.com/u/TiE23)\
**Post date:** [October 26, 2023, 6:03pm UTC](https://community.apollographql.com/t/recommended-health-check-strategy-is-impossible-using-aws-load-balancer/6323/5 "2023-10-26T18:03:20Z")

</div>

Appreciate the tip. It took me a bit of scratching my head (and just asking ChatGPT) to recognize that this snippet of code had to be executed before `app.use()`, otherwise Apollo’s CSRF rule will still affect the outcome.

---

<div class="post-metadata">

**Author:** ![Justin\_Gonzalez](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/justin_gonzalez/32/5359_2.png) [@Justin\_Gonzalez](https://community.apollographql.com/u/Justin_Gonzalez)\
**Post date:** [February 6, 2025, 8:48pm UTC](https://community.apollographql.com/t/recommended-health-check-strategy-is-impossible-using-aws-load-balancer/6323/6 "2025-02-06T20:48:04Z")

</div>