Attempt to spoof header (HTTP_SHIBSESSIONID:) was detected.

[Bobby Lawrence]

Just an FYI - you are stuck relying on headers if you are using the Tomcat connector for IIS.  It does not pass server variables from IIS to the underlying Tomcat instance.  

> -----Original Message-----
> From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott via users
> Sent: Monday, July 21, 2025 10:06 AM
> To: Shib Users <users at shibboleth.net>
> Cc: Cantor, Scott <cantor.2 at osu.edu>
> Subject: [EXTERNAL] Re: Attempt to spoof header (HTTP_SHIBSESSIONID:) was detected.
> 
> You can't get that error unless a client (proxy or otherwise) is lterally passing in a request with that header set.
> 
> You shouldn't use headers and you don't need them, ergo, turn them off and you'll avoid the problem. That's the important takeaway.
> 
> If you insist on using them, then you can't fix this without tracking down the broken proxy. The requests internally get a special "secret"
> header value added that it uses to detect if "the module" placed the other headers into the request or if a client might have smuggled
> one in.
> 
> The fact that it raises the exception means that special header was not detected but the other header was, ergo it's an attack and it
> flags it.
> 
> -- Scott
> 
> 
> --
> For Consortium Member technical support, see https://urldefense.proofpoint.com/v2/url?u=https-
> 3A__shibboleth.atlassian.net_wiki_x_ZYEpPw&d=DwICAg&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJe
> DGwtg&m=zXNA3N0f96hDbeO4jGcURSZ_UkBM_vp1YYSgJxyYMKRXp78fvUu850UORN_XQ-n7&s=YP--s-
> 7CzqwH9ds3MacoOBXGy4wHf51_ziJqvvMSgx4&e=
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net