Source:
private void attemptAuthentication(HttpServerRequest request) throws HttpAuthenticationException { String username = request.getFirstParameterValue(USERNAME); String password = request.getFirstParameterValue(PASSWORD); if (username == null || username.trim().length() == 0 || password == null) { error(httpForm.usernameOrPasswordMissing(), request); return; } char[] passwordChars = password.toCharArray(); try { if (authenticate(null, username, passwordChars)) { IdentityCache identityCache = createIdentityCache(request, true); if (authorize(username, request, identityCache)) { httpForm.debugf("User [%s] authenticated successfully", username); succeed(); HttpScope session = getSessionScope(request, true); HttpServerMechanismsResponder responder = null; if (session != null && session.exists()) { String postAuthenticationPath; String originalPath = session.getAttachment(LOCATION_KEY, String.class); if (originalPath != null) { postAuthenticationPath = originalPath; httpForm.tracef("User redirected to original path [%s]", postAuthenticationPath); } else { URI requestUri = request.getRequestURI(); String currentPath = requestUri.getPath(); StringBuilder sb = new StringBuilder(); sb.append(requestUri.getScheme()); sb.append("://"); sb.append(requestUri.getHost()); sb.append(':').append(requestUri.getPort()); sb.append(currentPath.substring(0, currentPath.indexOf(DEFAULT_POST_LOCATION))); postAuthenticationPath = sb.toString(); httpForm.tracef("User redirected to default path [%s]", postAuthenticationPath); } session.setAttachment(LOCATION_KEY, null); responder = (response) -> sendRedirect(response, postAuthenticationPath); } request.authenticationComplete(responder, identityCache::remove); return; } else { httpForm.debugf("User [%s] authorization failed", username); failAndRedirectToErrorPage(request, username); return; } } else { httpForm.debugf("User [%s] authentication failed", username); failAndRedirectToErrorPage(request, username); return; } } catch (IOException | UnsupportedCallbackException e) { throw new HttpAuthenticationException(e); } finally { fill(passwordChars, (char) 0x00); } }

Target:
private void attemptAuthentication(HttpServerRequest request) throws HttpAuthenticationException { String username = request.getFirstParameterValue(USERNAME); String password = request.getFirstParameterValue(PASSWORD); if (username == null || username.length() == 0 || password == null) { error(httpForm.usernameOrPasswordMissing(), request); return; } char[] passwordChars = password.toCharArray(); try { if (authenticate(null, username, passwordChars)) { IdentityCache identityCache = createIdentityCache(request, true); if (authorize(username, request, identityCache)) { httpForm.debugf("User [%s] authenticated successfully", username); succeed(); HttpScope session = getSessionScope(request, true); HttpServerMechanismsResponder responder = null; if (session != null && session.exists()) { String postAuthenticationPath; String originalPath = session.getAttachment(LOCATION_KEY, String.class); if (originalPath != null) { postAuthenticationPath = originalPath; httpForm.tracef("User redirected to original path [%s]", postAuthenticationPath); } else { URI requestUri = request.getRequestURI(); String currentPath = requestUri.getPath(); StringBuilder sb = new StringBuilder(); sb.append(requestUri.getScheme()); sb.append("://"); sb.append(requestUri.getHost()); sb.append(':').append(requestUri.getPort()); sb.append(currentPath.substring(0, currentPath.indexOf(DEFAULT_POST_LOCATION))); postAuthenticationPath = sb.toString(); httpForm.tracef("User redirected to default path [%s]", postAuthenticationPath); } session.setAttachment(LOCATION_KEY, null); responder = (response) -> sendRedirect(response, postAuthenticationPath); } request.authenticationComplete(responder, identityCache::remove); return; } else { httpForm.debugf("User [%s] authorization failed", username); failAndRedirectToErrorPage(request, username); return; } } else { httpForm.debugf("User [%s] authentication failed", username); failAndRedirectToErrorPage(request, username); return; } } catch (IOException | UnsupportedCallbackException e) { throw new HttpAuthenticationException(e); } finally { fill(passwordChars, (char) 0x00); } }