Authenticator (Java SE 26 & JDK 26)
Description: declaration: module: jdk.httpserver, package: com.sun.net.httpserver, class: Authenticator
Keywords: com.sun.net.httpserver.Authenticator class

# Class Authenticator

java.lang.Object
com.sun.net.httpserver.Authenticator

Direct Known Subclasses:
  `BasicAuthenticator`

public abstract class Authenticator extends Object
Authenticator represents an implementation of an HTTP authentication mechanism. Sub-classes provide implementations of specific mechanisms such as Digest or Basic auth. Instances are invoked to provide verification of the authentication information provided in all incoming requests. Note. This implies that any caching of credentials or other authentication information must be done outside of this class.

Since:
  1.6

- ## Nested Class Summary

  Nested Classes
  Modifier and Type
  Class
  Description
  `static class`
  `Authenticator.Failure`
  Indicates an authentication failure.
  `static class`
  `Authenticator.Result`
  Base class for return type from `authenticate(HttpExchange)` method.
  `static class`
  `Authenticator.Retry`
  Indicates an authentication must be retried.
  `static class`
  `Authenticator.Success`
  Indicates an authentication has succeeded and the authenticated user principal can be acquired by calling `Authenticator.Success.getPrincipal()`.

- ## Constructor Summary

  Constructors
  Modifier
  Constructor
  Description
  `protected`
  `Authenticator()`
  Constructor for subclasses to call.

- ## Method Summary

  Modifier and Type
  Method
  Description
  `abstract Authenticator.Result`
  `authenticate(HttpExchange exch)`
  Called to authenticate each incoming request.

  ### Methods declared in class Object

  `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`
  Modifier and Type
  Method
  Description
  `protected Object`
  `clone()`
  Creates and returns a copy of this object.
  `boolean`
  `equals(Object obj)`
  Indicates whether some other object is "equal to" this one.
  `protected void`
  `finalize()`
  Deprecated, for removal: This API element is subject to removal in a future version.
  Finalization is deprecated and subject to removal in a future release.
  `final Class<?>`
  `getClass()`
  Returns the runtime class of this `Object`.
  `int`
  `hashCode()`
  Returns a hash code value for this object.
  `final void`
  `notify()`
  Wakes up a single thread that is waiting on this object's monitor.
  `final void`
  `notifyAll()`
  Wakes up all threads that are waiting on this object's monitor.
  `String`
  `toString()`
  Returns a string representation of the object.
  `final void`
  `wait()`
  Causes the current thread to wait until it is awakened, typically by being notified or interrupted.
  `final void`
  `wait(long timeoutMillis)`
  Causes the current thread to wait until it is awakened, typically by being notified or interrupted, or until a certain amount of real time has elapsed.
  `final void`
  `wait(long timeoutMillis, int nanos)`
  Causes the current thread to wait until it is awakened, typically by being notified or interrupted, or until a certain amount of real time has elapsed.

- ## Constructor Details

  - ### Authenticator

    protected Authenticator()
    Constructor for subclasses to call.

- ## Method Details

  - ### authenticate

    public abstract Authenticator.Result authenticate(HttpExchange exch)
    Called to authenticate each incoming request. The implementation must return a `Authenticator.Failure`, `Authenticator.Success` or `Authenticator.Retry` object as appropriate:
    - `Failure` means the authentication has completed, but has failed due to invalid credentials.
    - `Success` means that the authentication has succeeded, and a `Principal` object representing the user can be retrieved by calling `Authenticator.Success.getPrincipal()`.
    - `Retry` means that another HTTP exchange is required. Any response headers needing to be sent back to the client are set in the given `HttpExchange`. The response code to be returned must be provided in the `Retry` object. `Retry` may occur multiple times.
    Parameters:
      `exch` - the `HttpExchange` upon which authenticate is called
    Returns:
      the result