@Override
    public final Optional<RedirectionAction> getRedirectionAction(final CallContext ctx) {
        init();

        val webContext = ctx.webContext();
        val sessionStore = ctx.sessionStore();

        // it's an AJAX request -> appropriate action
        if (ajaxRequestResolver.isAjax(ctx)) {
            val httpAction = ajaxRequestResolver.buildAjaxResponse(ctx, redirectionActionBuilder);
            logger.debug("AJAX request detected -> returning " + httpAction + " for " + ctx.webContext().getFullRequestURL());
            cleanRequestedUrl(webContext, sessionStore);
            throw httpAction;
        }
        // authentication has already been tried -> unauthorized
        val attemptedAuth = sessionStore.get(webContext, getName() + ATTEMPTED_AUTHENTICATION_SUFFIX);
        if (attemptedAuth.isPresent() && !Pac4jConstants.EMPTY_STRING.equals(attemptedAuth.get())) {
            logger.debug("authentication already attempted -> 401");
            cleanAttemptedAuthentication(webContext, sessionStore);
            cleanRequestedUrl(webContext, sessionStore);
            throw HttpActionHelper.buildUnauthenticatedAction(webContext);
        }

        return redirectionActionBuilder.getRedirectionAction(ctx);
    }
{@inheritDoc}

<p>If an authentication has already been tried for this client and has failed (<code>null</code> credentials) or if the request is
an AJAX one, an unauthorized response is thrown instead of a "redirection".</p>
pac4j-core/src/main/java/org/pac4j/core/client/IndirectClient.java