src/main/java/js/servlet/AppServlet.java
protected static void sendUnauthorized(RequestContext context) {
		final ContainerSPI container = context.getContainer();
		final HttpServletResponse httpResponse = context.getResponse();

		if (httpResponse.isCommitted()) {
			log.fatal("Abort HTTP transaction. Attempt to send reponse after response already commited.");
			return;
		}
		log.error("Reject unauthorized request for private resource or service: |%s|.", context.getRequestURI());

		String loginPage = container.getLoginPage();
		if (HttpHeader.isXHR(context.getRequest()) && loginPage != null) {
			// XMLHttpRequest specs mandates that redirection codes to be performed transparently by user agent
			// this means redirect from server does not reach script counterpart
			// as workaround uses 200 OK and X-JSLIB-Location extension header
			log.trace("Send X-JSLIB-Location |%s| for rejected XHR request: |%s|", container.getLoginPage(), context.getRequestURI());
			httpResponse.setStatus(HttpServletResponse.SC_OK);
			httpResponse.setHeader(HttpHeader.X_HEADER_LOCATION, container.getLoginPage());
			return;
		}

		log.trace("Send WWW-Authenticate |Basic realm=%s| for rejected request: |%s|", container.getLoginRealm(), context.getRequestURI());
		httpResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
		httpResponse.setHeader(HttpHeader.WWW_AUTHENTICATE, String.format("Basic realm=%s", container.getLoginRealm()));
	}
protected static void sendUnauthorized(RequestContext context) {
		final ContainerSPI container = context.getContainer();
		final HttpServletResponse httpResponse = context.getResponse();

		if (httpResponse.isCommitted()) {
			log.fatal("Abort HTTP transaction. Attempt to send reponse after response already commited.");
			return;
		}
		log.error("Reject unauthorized request for private resource or service: |%s|.", context.getRequestURI());

		String loginPage = container.getLoginPage();
		if (HttpHeader.isXHR(context.getRequest()) && loginPage != null) {
			// XMLHttpRequest specs mandates that redirection codes to be performed transparently by user agent
			// this means redirect from server does not reach script counterpart
			// as workaround uses 200 OK and X-JSLIB-Location extension header
			log.trace("Send X-JSLIB-Location |%s| for rejected XHR request: |%s|", container.getLoginPage(), context.getRequestURI());
			httpResponse.setStatus(HttpServletResponse.SC_OK);
			httpResponse.setHeader(HttpHeader.X_HEADER_LOCATION, container.getLoginPage());
			return;
		}

		log.trace("Send WWW-Authenticate |Basic realm=%s| for rejected request: |%s|", container.getLoginRealm(), context.getRequestURI());
		httpResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
		httpResponse.setHeader(HttpHeader.WWW_AUTHENTICATE, String.format("Basic realm=%s", container.getLoginRealm()));
	}
protected static void sendUnauthorized ( RequestContext context ) { final ContainerSPI container = context . getContainer ( ) ; final HttpServletResponse httpResponse = context . getResponse ( ) ; if ( httpResponse . isCommitted ( ) ) { log . fatal ( "Abort HTTP transaction. Attempt to send reponse after response already commited." ) ; return ; } log . error ( "Reject unauthorized request for private resource or service: |%s|." , context . getRequestURI ( ) ) ; String loginPage = container . getLoginPage ( ) ; if ( HttpHeader . isXHR ( context . getRequest ( ) ) && loginPage != null ) { // XMLHttpRequest specs mandates that redirection codes to be performed transparently by user agent
 // this means redirect from server does not reach script counterpart
 // as workaround uses 200 OK and X-JSLIB-Location extension header
 log . trace ( "Send X-JSLIB-Location |%s| for rejected XHR request: |%s|" , container . getLoginPage ( ) , context . getRequestURI ( ) ) ; httpResponse . setStatus ( HttpServletResponse . SC_OK ) ; httpResponse . setHeader ( HttpHeader . X_HEADER_LOCATION , container . getLoginPage ( ) ) ; return ; } log . trace ( "Send WWW-Authenticate |Basic realm=%s| for rejected request: |%s|" , container . getLoginRealm ( ) , context . getRequestURI ( ) ) ; httpResponse . setStatus ( HttpServletResponse . SC_UNAUTHORIZED ) ; httpResponse . setHeader ( HttpHeader . WWW_AUTHENTICATE , String . format ( "Basic realm=%s" , container . getLoginRealm ( ) ) ) ; }
Send unauthorized access response. This method send back a response with status code
{@link HttpServletResponse#SC_UNAUTHORIZED} and response header {@link HttpHeader#WWW_AUTHENTICATE} set to basic
authentication method and {@link ContainerSPI#getLoginRealm()} authentication realm.
<p>
If request is from an agent using XHR this method behaves a little different. XHR specification mandates that
unauthorized access to be handled transparently by client agent that usually displays client agent login form, not very
well integrated with application. Below is a snippet from this framework script library.
<p>
For not authorized XHR requests this method sends {@link HttpServletResponse#SC_OK} and custom response header
{@link HttpHeader#X_HEADER_LOCATION} set to application login page, see {@link ContainerSPI#getLoginPage()}. Client
script can handle this response and redirect to given login page.

<pre>
var redirect = this._request.getResponseHeader(&quot;X-JSLIB-Location&quot;);
if (redirect) {
WinMain.assign(redirect);
}
</pre>
<p>
Anyway, if application is not configured with login page, for rejected XHR requests this method still uses standard
{@link HttpServletResponse#SC_UNAUTHORIZED}.

@param context current request context.
Send unauthorized access response . This method send back a response with status code { @link HttpServletResponse#SC_UNAUTHORIZED } and response header { @link HttpHeader#WWW_AUTHENTICATE } set to basic authentication method and { @link ContainerSPI#getLoginRealm () } authentication realm . <p > If request is from an agent using XHR this method behaves a little different . XHR specification mandates that unauthorized access to be handled transparently by client agent that usually displays client agent login form not very well integrated with application . Below is a snippet from this framework script library . <p > For not authorized XHR requests this method sends { @link HttpServletResponse#SC_OK } and custom response header { @link HttpHeader#X_HEADER_LOCATION } set to application login page see { @link ContainerSPI#getLoginPage () } . Client script can handle this response and redirect to given login page .