Optional ReadonlycredentialWhere this strategy reads its credential. 'header' — a credential the client sends explicitly (a bearer or
API-key header); 'cookie' — one the browser attaches by itself (a session cookie). Read by form CSRF: only a
request authenticated by a 'header' strategy may skip the synchronizer-token check. Absent is treated as
'cookie' (fail closed).
ReadonlynameStrategy name for identification.
Attempt to authenticate the request.
The incoming request
The authenticated principal, or null if no credentials found
Authentication strategy interface. Implementations extract credentials from a request and return a principal, or
nullif the strategy does not apply.Since
0.1.0