Attempt to spoof header (HTTP_SHIBSESSIONID:) was detected.

[Cantor, Scott]

> I don't know that IIS gives you the ability to set your own
> headers based on server variables.

It doesn't, as it's not fit for purpose as a web server. It's a .NET engine masquerading as a general purpose tool.

> Even so, I would be hesitant to do that as the SP guards
> against its known headers but wouldn't guard against ones
> that I come up with so it might make them easier to spoof if
> anyone found out what they were named.

You can't secure a system by secrecy, but having said which, you can actually. If you map some attribute to a header name but the attribute doesn't exist, the SP will have to guard it.

> I brought this up to the Apache devs as an issue only because
> the AJP connector for Apache HTTP Server has a way to pass
> server variables down to Tomcat but its IIS counterpart does
> not. 

I didn't realize they even provided the IIS one, but that likely is because it dates to the old version of IIS in which you couldn't even set server variables, that's what created this mess to start with. They'd have to rewrite it altogether if it's based on the old API, as we did. 

-- Scott