in src/main/java/org/apache/sling/auth/core/impl/SlingAuthenticator.java [847:865]
boolean isAnonAllowed(HttpServletRequest request) {
String path = getPath(request);
final Collection<AuthenticationRequirementHolder>[] holderSetArray = this.authenticationRequirementsManager.findApplicableHolders(request);
for (int m = 0; m < holderSetArray.length; m++) {
final Collection<AuthenticationRequirementHolder> holders = holderSetArray[m];
if (holders != null) {
for (AuthenticationRequirementHolder holder : holders) {
if (holder.isPathRequiresHandler(path)) {
return !holder.requiresAuthentication();
}
}
}
}
// fallback to anonymous not allowed (aka authentication required)
return false;
}