SP assistance needed for "Attempt to spoof header"

[Cantor, Scott]

> Thanks Scott. I've been tracing and comparing the headers but I'm afraid I
> need the explanation broken down even more so I can understand. Sorry to
> show so much naivety, but how can I tell what headers the SP has been told
> to set and control so I can determine what may have been smuggled in to set
> off the spoof alarm?

The built-in headers documented in the wiki and whatever you map in your attribute config, that's it. It's telling you the header that's being spoofed anyway.

Nobody is suggesting some client is deliberately attacking it, the issue is some recursive, proxied, what in the hell does it think it's doing loopback thing that's sending out requests issued by the server to itself that are somehow inheriting the headers already set by the software.

I doubt it's anything that could be fixed unless the resource it's requesting doesn't have to be protected by the SP, so if the URLs were recognizable they could be exempted.

I'm a little unclear where IIS comes into this, BTW. If this is Peoplesoft, you shouldn't need IIS. Use Apache, don't use headers to carry the data, and that probably solves it.

-- Scott