Skip to main content

Realm

property Realm: string read write;

Example​

procedure ScriptEvent(var Value: variant);
begin
  if Response <> nil then
  begin
    Response.Realm := 'Velox API';
    Value := Response.Realm;
  end;
end;

Usage​

Sets Velox's authentication realm, which forces status 401 at header write and supplies a Basic challenge when no explicit challenge list exists.

Additional Technical Info​

Realm maps to Indy's AuthRealm and has active send-time behavior, not just metadata. When it is nonempty, WriteHeader forces StatusCode := 401 after Velox's normal post-action status selection.

If neither ContentString nor Content is present, Indy also creates an HTML 401 status body and sets text/html; charset=utf-8. Existing text/stream content is retained, but the final status is still 401.

At header construction:

  • if WWWAuthenticate contains one or more challenges, those entries are emitted and take precedence; or
  • if that list is empty, Indy creates WWW-Authenticate: Basic realm="<Realm>".

The realm is inserted into the quoted Basic challenge without application-level escaping. Never include a quote, backslash, CR/LF, control character, secret or attacker-controlled text. A realm identifies a protection space; it is not a credential, authorisation decision or login prompt, and setting it does not authenticate the caller.

Clear Realm to avoid the forced-401/Basic fallback. If a modern scheme such as Bearer is required without Basic fallback, leave Realm empty, set a complete WWWAuthenticate challenge and ensure the action's final status is 401. Test Response for nil.

External references

Created 2026-07-15