Attempt to spoof header (HTTP_SHIBSESSIONID:) was detected.

[Cantor, Scott]

You can't get that error unless a client (proxy or otherwise) is lterally passing in a request with that header set.

You shouldn't use headers and you don't need them, ergo, turn them off and you'll avoid the problem. That's the important takeaway.

If you insist on using them, then you can't fix this without tracking down the broken proxy. The requests internally get a special "secret" header value added that it uses to detect if "the module" placed the other headers into the request or if a client might have smuggled one in.

The fact that it raises the exception means that special header was not detected but the other header was, ergo it's an attack and it flags it.

-- Scott