@Override
    public Optional<Credentials> getCredentials(final CallContext ctx) {
        // set the www-authenticate in case of error
        val nonce = calculateNonce();
        ctx.webContext().setResponseHeader(HttpConstants.AUTHENTICATE_HEADER, "Digest realm=\"" + realm + "\", qop=\"auth\", nonce=\""
            + nonce + "\"");

        return super.getCredentials(ctx);
    }
{@inheritDoc}

Per RFC 2617
If a server receives a request for an access-protected object, and an
acceptable Authorization header is not sent, the server responds with
a "401 Unauthorized" status code, and a WWW-Authenticate header
pac4j-http/src/main/java/org/pac4j/http/client/direct/DirectDigestAuthClient.java