Also note that Restlet provides an API for a RESTful application. This means that you can access the standard headers using this API. In most cases, you do not need to use an attribute named "org.restlet.http.headers".
For example, if you want to set the Location header in the response, you add this code:
getResponse().setLocationRef("http://...");
Otherwise, since you are talking about security, Restlet provides a common API to support this aspect (see the ChallengeAuthenticator, Verifier, Enroler classes).
Hope this helps you. Thierry
source share