Attempt to spoof header (HTTP_SHIBSESSIONID:) was detected.

[Damian Crawford (JCAD)]

Hi

We have an IIS server running Shibboleth SP 3.5.0 sitting behind and Azure Application Gateway. The server is running multiple sites which are accessed via SSO.

We are getting this error reported on one site only, all other sites are working without issue. I cannot identity any differences between how this site has been configured and any of the others.

We have tested the configuration using the same URL but redirecting to our test servers and everything works fine so the configuration of the IDP must be fine.

All sites are redirected through the AGW using the same rules, rewrites and listeners so I cannot see anything that might be causing the issue.

Any ideas please?





Kind regards





Damian

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250721/1c91ec84/attachment.htm>