sp4a1, SubjectConfirmationData/@InResponseTo did not match the valid value: null

[Peter Schober]

Peter Schober via dev <dev at shibboleth.net> [2026-03-09 21:57 CET]:
> The initial request to the protected ressource (via TLS):
>   GET /secure
> yields this cookie response header:
>   set-cookie: __Host-shibsp_req_dc997c8834241275c3050ad8050f4b19=_10dcb66c73797f1471ee182aa3c98dd0; HttpOnly; Max-Age=-1; Path=/; SameSite=None; Secure
> plus a redirect to the external IDP.

Trying to set a cookie identical to the above from a CGI shell script
on the same web server I fail to set the cookie as well: Well, I can
set it but the User Agent does not return it in subsequent request
headers -- probably for the same reason the above fails:

> A zero or negative number will expire the cookie immediately.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#max-agenumber

Now the question is why is the cookie "set" (really: deleted) this
way?

-peter