admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
e78726314ea43aecaea37a2fc081edef922ea607
felhom.eu/documentation/audits/permanent-gate-2026-10-01/items-1-2.txt
T

37 lines
2.9 KiB
Plaintext
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
# items 1–2, 2026-10-01T19:20:31Z — 9202, throwaway familygate (forwardAuth), Grimmory v3.4.1 + MeTube 2026.09.29
## item 1 — a STRANGER (no cookie), from the LAN and through the simulated tunnel; GATE = the gate answered, APP = the app did
gm-spike GET / LAN 302 GATE | tunnel 302 GATE
gm-spike GET / LAN 401 GATE | tunnel 401 GATE
gm-spike GET /api/v1/books LAN 401 GATE | tunnel 401 GATE
gm-spike GET /api/v1/healthcheck LAN 401 GATE | tunnel 401 GATE
gm-spike GET /api/v1/public-settings LAN 401 GATE | tunnel 401 GATE
gm-spike POST /api/v1/setup LAN 401 GATE | tunnel 401 GATE
gm-spike POST /api/v1/auth/login LAN 401 GATE | tunnel 401 GATE
gm-spike GET /ws/websocket LAN 401 GATE | tunnel 401 GATE
gm-spike GET /assets/index.js LAN 401 GATE | tunnel 401 GATE
gm-spike GET /no-such-page LAN 302 GATE | tunnel 302 GATE
mt-spike GET / LAN 302 GATE | tunnel 302 GATE
mt-spike GET / LAN 401 GATE | tunnel 401 GATE
mt-spike GET /history LAN 401 GATE | tunnel 401 GATE
mt-spike POST /add LAN 401 GATE | tunnel 401 GATE
mt-spike GET /socket.io/?EIO=4&transport=polling LAN 401 GATE | tunnel 401 GATE
mt-spike GET /socket.io/?EIO=4&transport=websocket LAN 401 GATE | tunnel 401 GATE
mt-spike GET /download/x.mp4 LAN 401 GATE | tunnel 401 GATE
mt-spike GET /version LAN 401 GATE | tunnel 401 GATE
item 1: 0 app answers of 36 stranger requests -> PASS
## item 2 — family members with their OWN logins (not the dashboard password)
anna signs in on gm-spike.enkisfelhom.hu: 302; cookie set; Max-Age 2592000 s = 30 days; flags: HttpOnly, Secure, SameSite=Lax; Domain attr: none (host-only)
anna GET gm-spike.enkisfelhom.hu/ -> 200 APP
anna GET gm-spike.enkisfelhom.hu/api/v1/healthcheck -> 406 APP
bela signs in on mt-spike.enkisfelhom.hu: 302; cookie set
bela GET mt-spike.enkisfelhom.hu/ -> 200 APP
bela GET mt-spike.enkisfelhom.hu/socket.io/?EIO=4&transport=polling -> 200 APP
bela GET mt-spike.enkisfelhom.hu/socket.io/?EIO=4&transport=websocket -> 400 APP
bela GET mt-spike.enkisfelhom.hu/history -> 200 APP
bela's MeTube cookie sent to Grimmory -> 302 GATE (a session is per app host)
a made-up session id -> 302 GATE
after the gate RESTARTED, anna's cookie -> 200 APP (session survived)
anna logs out -> 302 /__family/login
anna's OLD cookie after logout -> 302 GATE (refused)
anna with a WRONG password -> 401, cookie none
Reference in New Issue View Git Blame Copy Permalink