Source:
<code>private boolean authenticate() throws HttpAuthenticationException { List<HttpServerAuthenticationMechanism> authenticationMechanisms = mechanismSupplier.get(); if (required && authenticationMechanisms.size() == 0) { throw log.httpAuthenticationNoMechanisms(); } responders = new ArrayList<>(authenticationMechanisms.size()); boolean evaluationFailed = false; try { for (HttpServerAuthenticationMechanism nextMechanism : authenticationMechanisms) { currentMechanism = nextMechanism; try { nextMechanism.evaluateRequest(this); } catch (HttpAuthenticationException e) { evaluationFailed = true; log.trace("Request evaluation for mechanism '%s' failed.", nextMechanism.getMechanismName(), e); } if (isAuthenticated()) { if (successResponder != null) { statusCodeAllowed = true; successResponder.sendResponse(this); if (statusCode > 0) { httpExchangeSpi.setStatusCode(statusCode); return false; } } return true; } } currentMechanism = null; if (required || (authenticationAttempted && ignoreOptionalFailures == false)) { statusCodeAllowed = true; if (responders.size() > 0) { boolean atLeastOneChallenge = false; boolean statusSet = false; for (HttpServerMechanismsResponder responder : responders) { try { responder.sendResponse(this); atLeastOneChallenge = true; if (statusSet == false && statusCode > 0 && statusCode != OK) { httpExchangeSpi.setStatusCode(statusCode); statusSet = true; } } catch (HttpAuthenticationException e) { log.trace("HTTP Authentication mechanism unable to send challenge.", e); } } if (atLeastOneChallenge == false) { throw log.httpAuthenticationNoSuccessfulResponder(); } if (statusSet == false) { <START> httpExchangeSpi.setStatusCode(FORBIDDEN); <END> } } else { if (evaluationFailed) { throw log.httpAuthenticationFailedEvaluatingRequest(); } httpExchangeSpi.setStatusCode(FORBIDDEN); } return false; } return true; } finally { authenticationMechanisms.forEach(m -> m.dispose()); } }</code><technical_language>This a big change in behaviour, I previous intent default 'OK' if mechanism wanted a specific - FORBIDDEN scenario picked previously</technical_language>

Target:
private boolean authenticate() throws HttpAuthenticationException { List<HttpServerAuthenticationMechanism> authenticationMechanisms = mechanismSupplier.get(); if (required && authenticationMechanisms.size() == 0) { throw log.httpAuthenticationNoMechanisms(); } responders = new ArrayList<>(authenticationMechanisms.size()); boolean evaluationFailed = false; try { for (HttpServerAuthenticationMechanism nextMechanism : authenticationMechanisms) { currentMechanism = nextMechanism; try { nextMechanism.evaluateRequest(this); } catch (HttpAuthenticationException e) { evaluationFailed = true; log.trace("Request evaluation for mechanism '%s' failed.", nextMechanism.getMechanismName(), e); } if (isAuthenticated()) { if (successResponder != null) { statusCodeAllowed = true; successResponder.sendResponse(this); if (statusCode > 0) { httpExchangeSpi.setStatusCode(statusCode); return false; } } return true; } } currentMechanism = null; if (required || (authenticationAttempted && ignoreOptionalFailures == false)) { statusCodeAllowed = true; if (responders.size() > 0) { boolean atLeastOneChallenge = false; int defaultStatusCode = OK; boolean statusSet = false; for (HttpServerMechanismsResponder responder : responders) { try { responder.sendResponse(this); atLeastOneChallenge = true; if ( ! statusSet && statusCode > 0) { if (statusCode == FORBIDDEN) { defaultStatusCode = statusCode; } else if (statusCode != OK) { statusSet = true; httpExchangeSpi.setStatusCode(statusCode); } } } catch (HttpAuthenticationException e) { log.trace("HTTP Authentication mechanism unable to send challenge.", e); } } if (atLeastOneChallenge == false) { throw log.httpAuthenticationNoSuccessfulResponder(); } if ( ! statusSet) { httpExchangeSpi.setStatusCode(defaultStatusCode); } } else { if (evaluationFailed) { throw log.httpAuthenticationFailedEvaluatingRequest(); } httpExchangeSpi.setStatusCode(FORBIDDEN); } return false; } return true; } finally { authenticationMechanisms.forEach(m -> m.dispose()); } }