title: WSO2 ESB secure API with HTTP Basic
body: <p>I'm using WSO2 ESB 4.8.1 and I have implemented the authentication handler suggested by WSO2 documentation: <a href="https://docs.wso2.com/display/ESB481/Securing+APIs?src=search" rel="nofollow">https://docs.wso2.com/display/ESB481/Securing+APIs?src=search</a>
  When the incoming user isn't authenticated successfully the piece of code that should return an error to the client is executed:</p>
  
  <pre><code>                headersMap.clear();
                  axis2MessageContext.setProperty("HTTP_SC", "403");
                  axis2MessageContext.setProperty("NO_ENTITY_BODY", new Boolean("true"));
                  messageContext.setProperty("RESPONSE", "true");
                  messageContext.setTo(null);
                  Axis2Sender.sendBack(messageContext);
                  return false;
  </code></pre>
  
  <p>Unfortunately this doesn't have any effect, i.e. the unauthenticated user is still able to invoke the API. Does the WSO2 ESB 4.8.1 documentation miss anything here?</p>
  
  <p>Kind regards,</p>
  
  <p>Heiko</p>