rephrase text on the OIDCUnAuthAction expression and add more examples
see
# "407" means that HTTP 407 Proxy Authentication Required is returned
# "410" means that HTTP 410 Gone is returned
# "pass" means that an unauthenticated request will pass but claims will still be passed when a user happens to be authenticated already
-#
# Useful in Location/Directory/Proxy path contexts that serve AJAX/Javascript calls and for "anonymous access"
#
+# When not defined the default is "auth" with auto-detection of XML HTTP requests, returning "401".
+# The default auto-detection algorithm looks for the "X-Requested-With: XMLHttpRequest" header/value,
+# and/or the absence of "Accept" header with any of the values "text/html" "application/xhtml+xml" or "*/*"
+#
# Since verson 2.4.4 a boolean Apache expression as the second parameter to specify which requests
-# need to match to return the configured value in the first parameter to override the default, e.g.:
+# need to match to return the configured value in the first parameter to override the default "auth".
+# See also: https://httpd.apache.org/docs/2.4/expr.html.
+# E.g.:
# OIDCUnAuthAction 401 "%{HTTP_USER_AGENT} =~ /curl/"
-# or:
+# to return 401 for cURL based user agents and "auth" for any other brwsers/user agents.
+# OIDCUnAuthAction 401 "%{HTTP:X-Requested-With} == 'XMLHttpRequest'"
+# to effectively override the default XML request detection algorithm by ignoring the Accept headers
+# OIDCUnAuthAction 401 "%{HTTP_ACCEPT} !~ m#text/html#"
+# to return 401 for all user agents that do not send an Accept header that includes a "text/html" value
+# OIDCUnAuthAction 401 "%{HTTP:X-Requested-With} == 'XMLHttpRequest' || ( ( %{HTTP_ACCEPT} !~ m#text/html# ) && ( %{HTTP_ACCEPT} !~ m#application/xhtml\+xml# ) && ( %{HTTP_ACCEPT} !~ m#\*/\*# ) )"
+# just as a more complex example, it equals the default XML request detection algorithm
# OIDCUnAuthAction auth true
-# See also: https://httpd.apache.org/docs/2.4/expr.html. Note that:
-# a. the default is "auth" with auto-detection of XML HTTP requests (returning 401 for the latter)
-# b. only one such primitive can be configured per location, overriding the default processing from a.
-# c. whenever an expression is configured, auto-detection of non-browser requests will be disabled, so:
-# the 1st example will no longer auto-detect XML HTTP requests and non "curl" user agents will fall through to the default "auth"
-# the 2nd example above overrides the auto-detection from a., redirecting all requests
-# note that because of the above an "auth" value with *any* expression ("true", or "false"(!), or other)
-# will effectively merely disable auto-detection of non-browser requests and render "auth"
-# When not defined the default is "auth" with auto-detection of XML HTTP requests, returning "401".
+# To distable auto-detection of XML HTTP request altogether and uncondtionally return "auth" for all clients.
+# Note that actually any expression value in "OIDCUnAuthAction auth <expr>" will always render "auth"
+# because of the default (even when set to "false"...), so using an <expr> only makes sense in
+# combination with one of the other 401/407/410/pass values.
#OIDCUnAuthAction [auth|pass|401|407|410] [<expr>]
# Defines the action to be taken when an unauthorized request is made i.e. the user is authenticated but
