400 status

I ran into this issue (unexpected HTTP 400 status codes) and here's what I learned. My symptoms were as follows:
Load balancer requests to /health returned HTTP 400
Requests to /health from the host itself also returned HTTP 400 (e.g.: wget http://localhost/health).
Requests to /health from the internet worked.

The underlying problem was with $settings['trusted_host_patterns'] in settings.php. Both localhost and the host name the load balancers were using to request /health were not in $settings['trusted_host_patterns'].

My webhosts are on AWS, so adding these values to $settings['trusted_host_patterns'] made things work:

  // To allow wget and curl to work on individual webhosts.
  '^localhost$',

  // AWS EC2 internal IP-based host patterns to allow /health to work as the ELB ping route.
  '^ip-' . str_replace('.', '-', gethostbyname(gethostname())) . '\\.ec2\\.internal$',
  '^.+\\.ip-' . str_replace('.', '-', gethostbyname(gethostname())) . '\\.ec2\\.internal$',
  '^' . str_replace('.', '\\.', gethostbyname(gethostname())) . '$',
  '^+\\.' . str_replace('.', '\\.', gethostbyname(gethostname())) . '$',

The specific patterns above might not work for your situation, but for those experiencing unexpected HTTP 400s when /health is requested one possible solution is to figure out the hostname being used to when those problematic requests to /health are being made and getting those into $settings['trusted_host_patterns'].

I'm seeing the same thing if I point my aws load balancer health check to any other path its fine with the following trusted_hosts_pattern

$settings['trusted_host_patterns'] = [
  '^10\.0\.\d{1,3}\.\d{1,3}$', // Allow all 10.0.x.x IP addresses
];

It's just the health path that returns a 400 error

Not sure why but adding a trailing / to the path fixes the issue i.e /health/