Attempt to spoof header (Shib-Cookie-Name) was detected

[reda sabir]

>
> you should pass the client address in a header, and then it can pick that
> header up via the REMOTE_ADDR setting.


Thank you Scott, I will look at this. Meanwhile, both of you had me
thinking that  httpd may also be able to change the hostname while proxying
which will be the easiest solution. And I have found that indeed Apache
allow that by changing  the header:

>   RequestHeader set Host "theportail.example.com"
>   ProxyPreserveHost On
>
So now I have the both vhost pointing to the same Backend APP (liferay) but
portail.example.com change only it's header to be theportail.example.com.
Also, both vhosts have the instructions for Shibboleth as if they were
different websites. This will allow me to let the protection against cookie
theft set to on. Of course, it will be also on if I used the Scott's
solution.

Thank you very much Scott and Peter for your hard work in responding and
helping all the users of Shibboleth. And as we say it in French : "Chapeau
bas",
Reda SABIR

2016-10-04 18:02 GMT+02:00 Cantor, Scott <cantor.2 at osu.edu>:

> > Of course, disabling protection from cookie theft is very bad idea and
> should
> > be avoided.An other solution would be to have a list of exceptions like
> > 127.0.0.1. So is there any way to do that, or is it not developed yet?
>
> If you're proxying you should pass the client address in a header, and
> then it can pick that header up via the REMOTE_ADDR setting.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161004/3dfa882c/attachment.html>