Attempt to spoof header (HTTP_SHIBSESSIONID:) was detected.

[Bobby Lawrence]

I don't know that IIS gives you the ability to set your own headers based on server variables.  Even so, I would be hesitant to do that as the SP guards against its known headers but wouldn't guard against ones that I come up with so it might make them easier to spoof if anyone found out what they were named.

I brought this up to the Apache devs as an issue only because the AJP connector for Apache HTTP Server has a way to pass server variables down to Tomcat but its IIS counterpart does not.  

> -----Original Message-----
> From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott via users
> Sent: Tuesday, July 29, 2025 8:23 AM
> To: users at shibboleth.net
> Cc: Cantor, Scott <cantor.2 at osu.edu>
> Subject: [EXTERNAL] Re: Attempt to spoof header (HTTP_SHIBSESSIONID:) was detected.
> 
> > I've also brought this up to the Apache tomcat connectors
> > devs:
> 
> Apache doesn't have the issue really, you can set your own headers as needed based on the server variables the SP sets, that's how it's
> meant to work.
> 
> If they're proxying HTTP to Tomcat, as with Jetty, you have to use headers on that leg, but that doesn't mean you have to set them on
> the front half to get them there.
> 
> -- Scott
> 
> 
> --
> For Consortium Member technical support, see https://urldefense.proofpoint.com/v2/url?u=https-
> 3A__shibboleth.atlassian.net_wiki_x_ZYEpPw&d=DwICAg&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJe
> DGwtg&m=hUmP-cxCCh1BnVcKoWCmpiF5173i6LnNT2x7I2nNwFNqhT6Ny3MBpA2NYfpNd3Pf&s=_Tr-
> Si_h95vWBF2ecHRrwBoxRj9vf7wp3hRTUhFIGjY&e=
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net