@ Override protected Optional < DigestCredentials > retrieveCredentials ( final WebContext context ) { // set the www-authenticate in case of error final String nonce = calculateNonce ( ) ; context . setResponseHeader ( HttpConstants . AUTHENTICATE_HEADER , "Digest realm=\"" + realm + "\", qop=\"auth\", nonce=\"" + nonce + "\"" ) ; return super . retrieveCredentials ( context ) ; }
Per RFC 2617 If a server receives a request for an access - protected object and an acceptable Authorization header is not sent the server responds with a 401 Unauthorized status code and a WWW - Authenticate header