Attempt to spoof header (HTTP_SHIBSESSIONID:) was detected.

[Damian Crawford (JCAD)]

Hi Scott

Yes we have useHeaders="true" in the <InProcess> section for a legacy site, but it is our intention to remove this so that  ServerVariables are used. 

So removing this setting should then remove the error being reported? We will test this tonight.

What would be the best approach to tracking down the header causing the issue? Presumably this occurs after authentication with the IDP has taken place.
 
 
Kind regards
 
 
Damian
 
 

-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu> 
Sent: 21 July 2025 15:06
To: Shib Users <users at shibboleth.net>
Cc: Damian Crawford (JCAD) <damian at jcad.co.uk>
Subject: Re: Attempt to spoof header (HTTP_SHIBSESSIONID:) was detected.

[You don't often get email from cantor.2 at osu.edu. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]

You can't get that error unless a client (proxy or otherwise) is lterally passing in a request with that header set.

You shouldn't use headers and you don't need them, ergo, turn them off and you'll avoid the problem. That's the important takeaway.

If you insist on using them, then you can't fix this without tracking down the broken proxy. The requests internally get a special "secret" header value added that it uses to detect if "the module" placed the other headers into the request or if a client might have smuggled one in.

The fact that it raises the exception means that special header was not detected but the other header was, ergo it's an attack and it flags it.

-- Scott