# items 1–2, 2026-10-01T19:20:31Z — 9202, throwaway familygate (forwardAuth), Grimmory v3.4.1 + MeTube 2026.09.29
## item 1 — a STRANGER (no cookie), from the LAN and through the simulated tunnel; GATE = the gate answered, APP = the app did
  gm-spike  GET  /                                          LAN 302 GATE | tunnel 302 GATE
  gm-spike  GET  /                                          LAN 401 GATE | tunnel 401 GATE
  gm-spike  GET  /api/v1/books                              LAN 401 GATE | tunnel 401 GATE
  gm-spike  GET  /api/v1/healthcheck                        LAN 401 GATE | tunnel 401 GATE
  gm-spike  GET  /api/v1/public-settings                    LAN 401 GATE | tunnel 401 GATE
  gm-spike  POST /api/v1/setup                              LAN 401 GATE | tunnel 401 GATE
  gm-spike  POST /api/v1/auth/login                         LAN 401 GATE | tunnel 401 GATE
  gm-spike  GET  /ws/websocket                              LAN 401 GATE | tunnel 401 GATE
  gm-spike  GET  /assets/index.js                           LAN 401 GATE | tunnel 401 GATE
  gm-spike  GET  /no-such-page                              LAN 302 GATE | tunnel 302 GATE
  mt-spike  GET  /                                          LAN 302 GATE | tunnel 302 GATE
  mt-spike  GET  /                                          LAN 401 GATE | tunnel 401 GATE
  mt-spike  GET  /history                                   LAN 401 GATE | tunnel 401 GATE
  mt-spike  POST /add                                       LAN 401 GATE | tunnel 401 GATE
  mt-spike  GET  /socket.io/?EIO=4&transport=polling        LAN 401 GATE | tunnel 401 GATE
  mt-spike  GET  /socket.io/?EIO=4&transport=websocket      LAN 401 GATE | tunnel 401 GATE
  mt-spike  GET  /download/x.mp4                            LAN 401 GATE | tunnel 401 GATE
  mt-spike  GET  /version                                   LAN 401 GATE | tunnel 401 GATE
item 1: 0 app answers of 36 stranger requests -> PASS
## item 2 — family members with their OWN logins (not the dashboard password)
  anna signs in on gm-spike.enkisfelhom.hu: 302; cookie set; Max-Age 2592000 s = 30 days; flags: HttpOnly, Secure, SameSite=Lax; Domain attr: none (host-only)
  anna GET gm-spike.enkisfelhom.hu/ -> 200 APP
  anna GET gm-spike.enkisfelhom.hu/api/v1/healthcheck -> 406 APP
  bela signs in on mt-spike.enkisfelhom.hu: 302; cookie set
  bela GET mt-spike.enkisfelhom.hu/ -> 200 APP
  bela GET mt-spike.enkisfelhom.hu/socket.io/?EIO=4&transport=polling -> 200 APP
  bela GET mt-spike.enkisfelhom.hu/socket.io/?EIO=4&transport=websocket -> 400 APP
  bela GET mt-spike.enkisfelhom.hu/history -> 200 APP
  bela's MeTube cookie sent to Grimmory -> 302 GATE (a session is per app host)
  a made-up session id -> 302 GATE
  after the gate RESTARTED, anna's cookie -> 200 APP (session survived)
  anna logs out -> 302 /__family/login
  anna's OLD cookie after logout -> 302 GATE (refused)
  anna with a WRONG password -> 401, cookie none