## 19:43:05 — FileBrowser 1.5.6 with auth.methods.proxy {enabled, header X-Felhom-User} on scratch 9202
### control route filesopen (no middleware)
no header:            401
forged header:        200  body: {"name":"scratch_hdd","size":132976640,"modified":"2026-10-18T20:34:20.752138936+02:00","type":"directory","hidden":fals
### strip route filesspike (forwardAuth -> controller /api/health, authResponseHeaders [X-Felhom-User])
no header:            404  body: 
<!DOCTYPE html>
<html lang="hu">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initi
forged header:        404  body: 
<!DOCTYPE html>
<html lang="hu">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initi
forged, other case:   404
forged, twice:        404

## 19:44:02 — auth stand-in: /always = 200 and NO user header; /cookie = 200 + X-Felhom-User: household-sso only with cookie spike=ok
### filesspike (forwardAuth /always, authResponseHeaders [X-Felhom-User])
header [none]: 401 {"status":401,"message":"no token present in request"}
header [X-Felhom-User: spike-stranger2]: 401 {"status":401,"message":"no token present in request"}
header [x-felhom-user: spike-stranger3]: 401 {"status":401,"message":"no token present in request"}
two forged headers: 401 {"status":401,"message":"no token present in request"}
### filessso (forwardAuth /cookie)
forged header, no cookie: 401 
cookie ok, no header: 404 404 page not found 
cookie ok + forged header attacker: 404 404 page not found 
### filessso again, on the drive listing (19:44:14)
cookie ok, no header: 200 {"name":"scratch_hdd","size":132976640,"modified":"2026-10-18T20:34:20.752138936+02:00","t
cookie ok + forged header attacker: 200 {"name":"scratch_hdd","size":132976640,"modified":"2026-10-18T20:34:20.752138936+02:00","t
cookie wrong + forged header attacker: 401 
### FileBrowser's own request log (user column) since 19:43
2026/10/18 21:43:05[33m GET     | 401 | 172.18.0.3      | N/A          | 0ms          | "/api/resources?path=%2F&source=SCRATCH%20HDD"[0m
2026/10/18 21:43:05 GET     | 200 | 172.18.0.3      | spike-stra.. | 80ms         | "/api/resources?path=%2F&source=SCRATCH%20HDD"
2026/10/18 21:44:02[33m GET     | 401 | 172.18.0.3      | N/A          | 0ms          | "/api/resources?path=%2F&source=SCRATCH%20HDD"[0m
2026/10/18 21:44:02[33m GET     | 401 | 172.18.0.3      | N/A          | 0ms          | "/api/resources?path=%2F&source=SCRATCH%20HDD"[0m
2026/10/18 21:44:02[33m GET     | 401 | 172.18.0.3      | N/A          | 0ms          | "/api/resources?path=%2F&source=SCRATCH%20HDD"[0m
2026/10/18 21:44:02[33m GET     | 401 | 172.18.0.3      | N/A          | 0ms          | "/api/resources?path=%2F&source=SCRATCH%20HDD"[0m
2026/10/18 21:44:14 GET     | 200 | 172.18.0.3      | household-.. | 79ms         | "/api/resources?path=%2F&source=SCRATCH%20HDD"
2026/10/18 21:44:14 GET     | 200 | 172.18.0.3      | household-.. | 2ms          | "/api/resources?path=%2F&source=SCRATCH%20HDD"
### an app container on traefik-public talks to FileBrowser directly, no router (19:44:27)
from nextcloud, no header: 401
from nextcloud, forged X-Felhom-User: app-forged: 200
nextcloud networks: nextcloud_nextcloud-internal traefik-public 
