Swift 5 URLRequest 授权头：保留，如何设置？

Question

在 Foundation 中Swift 的 URLRequest的文档中，它说为 URLRequest 设置标头值的标准方法不应用于保留的 HTTP 标头。

按照文档中更深入的保留 HTTP 标头列表的链接，它说它可能会忽略设置这些标头的尝试。

但它也说Authorization是一个保留的 HTTP 标头。

这不可能是对的，对吗？ Universe 中很大一部分 API 要求您在表单Authorization: Bearer {token}的标题中传递身份验证令牌

因此，如果 Swift 不允许您设置Authorization标头，那么如何访问这些 API 之一？

Answer 1

按照你们提到的文档，我现在结束了以下内容：

class ApiManager: NSObject {

    var credential: URLCredential?
    
    func token(withCredential credential: URLCredential?) {
        guard let url = URL(string: "\(K.API)/token") else {
            print("error URL: \(K.API)/token")
            return
        }

        self.credential = credential
        
        let session = URLSession(configuration: .default, delegate: self, delegateQueue: nil)
        
        var request = URLRequest(url: url)
        request.httpMethod = "POST"
        request.setValue("application/json", forHTTPHeaderField: "accept")
        request.setValue("application/json", forHTTPHeaderField: "content-type")
        
        let task = session.dataTask(with: request) { (data, response, error) in
            self.credential = nil
            
            if error != nil {
                print("URLSession error: \(error!.localizedDescription)")
                return
            }
            
            guard let safeHttpResponse = response as? HTTPURLResponse else {
                print("HTTPURLResponse error: \(error!.localizedDescription)")
                return
            }
            
            if safeHttpResponse.statusCode == 200,
               let safeData = data,
               let dataString = String(data: safeData, encoding: .utf8) {
                print("safeData: \(dataString)")
            } else {
                print("error: \(safeHttpResponse.statusCode)")
            }
        }
        
        task.resume()
    }
    
}

在这里， token是一种用于验证用户身份的方法。

我将类似的东西从 UI 传递给这个方法

URLCredential(user: usernameTextField.text, password: passwordTextField.text, persistence: .forSession)

然后最重要的，就是URLSessionTaskDelegate

extension ApiManager: URLSessionTaskDelegate {
    // From https://developer.apple.com/forums/thread/68809
    // We should use session delegate as setting Authorization Header won't always work
    
    func urlSession(
        _ session: URLSession,
        didReceive challenge: URLAuthenticationChallenge,
        completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
        // This method is called mainly with HTTPS url
        
        let protectionSpace = challenge.protectionSpace
        let authMethod = protectionSpace.authenticationMethod
        
        guard authMethod == NSURLAuthenticationMethodServerTrust, protectionSpace.host.contains(K.API.host) else {
            completionHandler(.performDefaultHandling, nil)
            return
        }
        
        guard let safeServerTrust = protectionSpace.serverTrust else {
            completionHandler(.performDefaultHandling, nil)
            return
        }
        
        DispatchQueue.global().async {
            SecTrustEvaluateAsyncWithError(safeServerTrust, DispatchQueue.global()) { (trust, result, error) in
                if result {
                    completionHandler(.useCredential, URLCredential(trust: trust))
                } else {
                    print("Trust failed: \(error!.localizedDescription)")
                    completionHandler(.performDefaultHandling, nil)
                }
            }
        }
    }
    
    func urlSession(
        _ session: URLSession,
        task: URLSessionTask,
        didReceive challenge: URLAuthenticationChallenge,
        completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
        // This method is called for authentication
        
        let protectionSpace = challenge.protectionSpace
        let authMethod = protectionSpace.authenticationMethod
        
        switch (authMethod, protectionSpace.host) {
            case (NSURLAuthenticationMethodHTTPBasic, K.API.host):
                self.basicAuth(didReceive: challenge, completionHandler: completionHandler)
            // we could add other authentication e.g Digest
            default:
                completionHandler(.performDefaultHandling, nil)
        }
    }
    
    private func basicAuth(
        didReceive challenge: URLAuthenticationChallenge,
        completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
        
        if challenge.previousFailureCount < 3 {
            completionHandler(.useCredential, self.credential)
        } else {
            completionHandler(.cancelAuthenticationChallenge, nil)
        }
    }
    
}

我这样称呼一切：

let apiManager = ApiManager()
let credential = URLCredential(user: email, password: password, persistence: .forSession)
apiManager.token(withCredential: credential)

例如，我必须使用 completionHandler 处理响应，但请求已通过身份验证并且可以正常工作

Answer 2

实施身份验证质询以处理基本身份验证，例如：

func urlSession(_ session: URLSession,
                didReceive challenge: URLAuthenticationChallenge,
                completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
    switch challenge.protectionSpace.authenticationMethod {
    case NSURLAuthenticationMethodHTTPBasic:
        performBasicAuthentication(challenge: challenge, completionHandler: completionHandler)
    default:
        completionHandler(.performDefaultHandling, nil)
    }
}

func performBasicAuthentication(challenge: URLAuthenticationChallenge, completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
    let credential = URLCredential(user: "username", password: "password", persistence: .forSession)
    completionHandler(.useCredential, credential)
}

这是参考链接