code: @Override
      protected Optional<DigestCredentials> retrieveCredentials(final WebContext context) {
          // set the www-authenticate in case of error
          final String nonce = calculateNonce();
          context.setResponseHeader(HttpConstants.AUTHENTICATE_HEADER, "Digest realm=\"" + realm + "\", qop=\"auth\", nonce=\""
              + nonce + "\"");
  
          return super.retrieveCredentials(context);
      }
docs: Per RFC 2617
  If a server receives a request for an access-protected object, and an
  acceptable Authorization header is not sent, the server responds with
  a "401 Unauthorized" status code, and a WWW-Authenticate header