[Hsnmohd]

CachingExec and AsyncCachingExec run above ProtocolExec, so the RFC 9111 3.5 shared-cache check never sees the Authorization header generated from the CredentialsProvider or AuthCache (the classic exec always sends a copy down the chain, and both protocol execs copy the request on a non-tunnelled proxy route), which let a 200 with Cache-Control: max-age=60 returned to alice's authenticated request be stored in the default shared cache and served to a context with no credentials; the fix treats the response as authenticated when the route target's AuthExchange is in SUCCESS state.

[ok2c]

@Hsnmohd Please move this test case to TestClientAuthentication

[ok2c]

@Hsnmohd Better yet, consider starting new test suites for caching clients (classic and async). There are TestAsyncServerResources, TestServerResources, CachingHttpAsyncClientResource, CachingHttpClientResource tests extensions that one can use to set up test resources required for such tests suites.

[arturobernalg]

I reproduced a case not covered by this fix: preemptive authentication sends Authorization while AuthExchange remains UNCHALLENGED, so isTargetAuthenticated() returns false.

Both classic and async caching clients serve Alice's cached private response to an anonymous request instead of returning 401.

We should cover this case before merging.