public static HttpAction buildUnauthenticatedAction(final WebContext context) {
        val hasHeader = context.getResponseHeader(HttpConstants.AUTHENTICATE_HEADER).isPresent();
        if (alwaysUse401ForUnauthenticated) {
            // add the WWW-Authenticate header to be compliant with the HTTP spec if it does not already exist
            if (!hasHeader) {
                context.setResponseHeader(HttpConstants.AUTHENTICATE_HEADER, HttpConstants.BEARER_HEADER_PREFIX + "realm=\"pac4j\"");
            }
            return new UnauthorizedAction();
        } else {
            if (hasHeader) {
                return new UnauthorizedAction();
            } else {
                return new ForbiddenAction();
            }
        }
    }
Build the action for unauthenticated users.

@param context the web context
@return the appropriate HTTP action
pac4j-core/src/main/java/org/pac4j/core/util/HttpActionHelper.java