code: @Sensitive
      protected String decodeBasicAuth(String data, String encoding) {
          String output = "";
          byte decodedByte[] = null;
          decodedByte = Base64Coder.base64DecodeString(data);
          if (decodedByte != null && decodedByte.length > 0) {
              boolean decoded = false;
              if (encoding != null) {
                  try {
                      output = new String(decodedByte, encoding);
                      decoded = true;
                  } catch (Exception e) {
                      // fall back not to use encoding..
                      if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                          Tr.debug(tc, "An exception is caught using the encoder: " + encoding + ". The exception is: " + e.getMessage());
                      }
                  }
              }
              if (!decoded) {
                  output = new String(decodedByte);
              }
          }
          return output;
      }
docs: 2. This method intentionally returns empty string in case of error. With that, a caller doesn't need to check null object prior to introspect it.