URLSession Token Authentication: What's the 'correct' way to do it?

Thanks eskimo, this is really helpful!

In regards to my thought on URLProtocol, I had some time last night to take a crack at it (for the sake of science, of course). By the time I was done, I had two thoughts:

1. Holy moly, this API needs some love.

2. Holy moly, this is pretty slick.

It was honestly very cool in the way I was able to hook into the didReceiveChallenge machinery and make it look like a native challenge by URLSession. All the crazy token stuff was handled in the background by the URLProtocol subclass and completely hidden to the user. By the end of my little experiment, the entirety of my front-facing client looked like:

let myBaseURL = URL(string: "my-custom-protocol://gateway.myserver.com")!
lazy var session: URLSession = {
    let configuration = URLSessionConfiguration.default
    configuration.protocolClasses = [MyURLProtocol.self]
    return URLSession(configuration: configuration, delegate: self, delegateQueue: nil)
}()

func urlSession(_ session: URLSession, task: URLSessionTask, didReceive challenge: URLAuthenticationChallenge, completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
    guard challenge.previousFailureCount < 5 else {
        completionHandler(.cancelAuthenticationChallenge, nil)
        return
    }

    if let proposedCredential = challenge.proposedCredential, proposedCredential.hasPassword {
        completionHandler(.useCredential, proposedCredential)
        return
    }

    switch challenge.protectionSpace.authenticationMethod {
    case NSURLAuthenticationMethodDefault where challenge.protectionSpace.protocol == "my-custom-protocol":
        completionHandler(.useCredential, URLCredential(user: "<username>", password: "<password>", persistence: .permanent))
    default:
        completionHandler(.cancelAuthenticationChallenge, nil)
    }
}

func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplicationLaunchOptionsKey: Any]?) -> Bool {
    let url = myBaseURL.appendingPathComponent("/some/data/endpoint/")
    let task = session.dataTask(with: url) { (data, response, error) in
        if let result = try? JSONSerialization.jsonObject(with: data!, options: JSONSerialization.ReadingOptions.allowFragments) as? NSDictionary {
            print(result)
        }
    }
    task.resume()
    return true
}

At the same time, the bit-rot is real. URLProtocol was clearly a product of its time and not designed for anything like URLSession in mind. Despite this, I really think there's potential here, so I gotta ask: is there hope for URLProtocol modernization in the near future (perhaps even it getting superceded by a new URLSessionProtocol class), or is the writing on the wall for this API?

NSURLProtocol

• A lot of folks use it recursively (à la the CustomHTTPProtocol sample code) and it was simply not designed for that.

• The protocol is only available within your process, and these days more and more subsystems are moving their networking out of process (most notably WKWebView and the media subsystem).

The second point is the real kicker. To fix this Apple would have to do something super clever, like host each protocol in its own app extension. That’s not impossible, but it would require a major engineering effort.

Back in the day (and I’m talking way back in the day, when the Foundation URL loading system was first introduced as part of Safari), you could put an

NSURLProtocol

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

is it still the case that the best thing to do is ignore the documentation and just set the Authorization header manually?

That depends.

We are using HTTP Digest authorisation, and it has "just worked".

NSURLSession has built-in support for Digest authentication (and some others) and if you need to authenticate using one of those mechanism you should use that support (that is, authentication challenges). If you need to authenticate using some other mechanism, like OAuth, your only option is to set the Authorization directly.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"