When using Apache and IIS, you should strongly consider porting applications to rely on system variables in place of request headers.
If this is not possible, the
checkSpoofing feature should be enabled. Server-side redirects, aliasing, and modules like mod_rewrite tend to cause false alarms because the SP detects headers that it itself has already created. To prevent this, the
spoofKey setting enables a special header as a way of detecting whether the headers being examined came from the SP or the client. The idea is to make it difficult for a client to guess this value and spoof the key, which then bypasses the spoof detection code.
On the IIS platform, a random key is automatically generated to ensure the detection feature works safely. On other platforms, you would need to establish the
spoofKey setting yourself. It should contain a suitably long, random value, and you MUST prevent the client from accessing any server-side scripts that might expose the key value through a dump of arbitrary request headers.