Improve Gateway authentication and static HTTP fidelity

README.md

@@ -55,7 +55,7 @@ English/German language JSON and gzip endpoints carry the default 14.1-29.63 per
 Translations are synthetic subsets, not original firmware files. If changing HONEYPOT_VERSION, also
 set HONEYPOT_ASSET_MTIME to that firmware's documented timestamp; metadata matching does not prove
 full firmware emulation. Gzip assets are returned with Content-Encoding and Last-Modified.
-Authentication XML includes credential requirements and a postback route; it grants no real access.
+Authentication XML includes credential requirements, state context, a postback route and error labels after credential submissions; it grants no real access. The browser requests the initial challenge and consumes the returned XML. Gateway CSS and JavaScript use local appliance-style paths; assets support ETag/Last-Modified revalidation and HEAD, without issuing session cookies. CSP reports are captured before a204 response; logout clears the cookie and redirects locally.
 `request_indicators` hunts header/body log markers and encoding hints without claiming a confirmed CVE.
 Bodies are inspected up to64KiB for these hints; complete accepted bodies remain captured independently.
 Run `python3 test_profile.py` for passive identification, gzip decoding/metadata, XML and capture checks.
@@ -139,7 +139,7 @@ vulnerability exists, a payload executes, or a CVE is conclusively identified.
 | Gateway login pages | `/`, `/vpn/`, `/vpn/index.html`, `/vpn/tmindex.html`, `/logon/LogonPoint/index.html`, `/logon/LogonPoint/tmindex.html`, `/logon/LogonPoint/custom.html`, `/menu/neo/`. German login UI, canonical Citrix Gateway title, NSC_ cookie and Gateway-shaped response headers. |
 | Gateway static fingerprints | Explicit rdx/CTXS JavaScript routes, login.js/init.js, original favicon/logo/background assets and AccessGateway.ico alias. Only routes in STATIC are supported; arbitrary files under these directories return404. |
 | Language/version fingerprints | English/German JSON and `.json.gz` under `/vpn/js/rdx/core/lang/` and `/vpn/js/rdx/core/lang-ext/`; gzip filename, build timestamp, Content-Encoding and Last-Modified. Synthetic translation subset with the default14.1-29.63 metadata. |
-| Authentication XML | `/nf/auth/*` returns credential requirements, state context and local postback. This is a repeated login challenge, not LDAP, SAML, MFA or successful real authentication. |
+| Authentication XML | `/nf/auth/getAuthenticationRequirements.do` and `/nf/auth/doAuthentication.do` return credential requirements, state context and local postback; credential submissions add an error label. Unknown authentication endpoints return404. This is a repeated login challenge, not LDAP, SAML, MFA or successful real authentication. |
 | NITRO authentication | `/nitro/v1/config/login` and logout with synthetic session tokens. Resource access accepts a matching fake token, nonempty X-NITRO-USER/X-NITRO-PASS, or a Basic authorization prefix. These are decoy rules, not real user/account validation. |
 | NITRO resources | `/nitro/v1/config/<resource>[/<name>]` and `/nitro/v1/stat/<resource>[/<name>]`;1,493 config and176 statistics names in [nitro-resources.json](nitro-resources.json). Common system/network/Gateway/AAA/SSL/LB/binding records are populated; other recognized resources return empty collections or generic counters. |
 | NITRO operations | Config reads, fake POST/PUT/DELETE, enable/disable/rename, inert administrative-action acknowledgements, attrs, literal filter/args, counts, pagesize and pageno. Unknown resources, invalid input, unsupported methods and unauthenticated access return simulator errors. |