HttpServletRequest.authenticate not asking for re-login
===

using the following code with the default configuration (HTTP Basic authentication + file realm in glassfish 3.1.2) as expected the client is asked for credentials. However, after a refresh or even on a new tab in the browser (even no cookies allowed, no passwords stored) the client is not asked anymore to re-enter the credentials. Only, when the browser is closed and re-opened will the client be asked again for the credentials. How is authenticate doing that?

    public class AuthenticateServlet extends HttpServlet {

        protected void processRequest(HttpServletRequest request,
                HttpServletResponse response)
                throws ServletException, IOException {
            response.setContentType("text/html;charset=UTF-8");
            PrintWriter out = response.getWriter();
            try {
                request.authenticate(response);
                out.println("Authenticate Successful");
            } finally {
                request.logout();
                out.close();
            }
        }

    [...]

    }


Regards,

Mike