Detected spoofed header: HTTP_SHIB_COOKIE_NAME

[Cantor, Scott]

> Thanks, Rod and Scott. Sure enough, setting authtype to an arbitrary undefined
> variable (authtype="disabled") did the trick. Thank you!

To be clear, that's more of a workaround and doesn't explain why it's happening, but it's fairly safe in the sense that it should prevent any of the headers from being set by the module.

You should verify that though, and you should be very careful that nothing living at any of those paths attempts to access the headers since nothing will stop a client from sending them.

Cold Fusion also has a history of doing very iffy stuff with the names you use to access variables and of conflating server variables and headers, so it's very simple to make egregious security mistakes with it. Or was, possibly not since it was ported into Java.

-- Scott