in src/main/java/org/apache/sling/auth/core/AuthUtil.java [370:392]
public static void sendInvalid(final HttpServletRequest request,
final HttpServletResponse response) {
checkAndReset(response);
try {
response.setStatus(HttpServletResponse.SC_FORBIDDEN);
Object reason = request.getAttribute(AuthenticationHandler.FAILURE_REASON);
Object reasonCode = request.getAttribute(AuthenticationHandler.FAILURE_REASON_CODE);
if (reason != null) {
response.setHeader(AuthConstants.X_REASON, reason.toString());
if ( reasonCode != null ) {
response.setHeader(AuthConstants.X_REASON_CODE, reasonCode.toString());
}
response.setContentType("text/plain");
response.setCharacterEncoding("UTF-8");
response.getWriter().println(reason);
}
response.flushBuffer();
} catch (IOException ioe) {
getLog().error("Failed to send 403/Forbidden response", ioe);
}
}