Disable URLSession auto retry policy

We are developing an iOS application that is interacting with HTTP APIs that requires us to put a unique UUID (a nonce) as an header on every request (obviously there's more than that, but that's irrilevant to the question here).

If the same nonce is sent on two subsequent requests the server returns a 412 error. We should avoid generating this kind of errors as, if repeated, they may be flagged as a malicious activity by the HTTP APIs.

We are using URLSession.shared.dataTaskPublisher(for: request) to call the HTTP APIs with request being generated with the unique nonce as an header.

On our field tests we are seeing a few cases of the same HTTP request (same nonce) being repeated a few seconds on after the other. Our code has some retry logic only on 401 errors, but that involves a token refresh, and this is not what we are seeing from logs.

We were able to replicate this behaviour on our own device using Network Link Conditioner with very bad performance, with XCode's Network inspector attached we can be certain that two HTTP requests with identical headers are actually made automatically, the first request has an "End Reason" of "Retry", the second is "Success" with Status 412.

Our questions are:

  • can we disable this behaviour?
  • can we provide a new request for the retry (so that we can update headers)?

Thanks, Francesco

Are these all GET requests?

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Yes, we have seen this happen on GET requests only, but please consider that at the moment we have found only two of these events as we are doing a private test with few devices and this is not yet released to the public.

Is this a server that you control?

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Yes, we control the server and have already considered some workarounds for these situations. I can't discuss the details for security reasons, but they would reduce the implementation's security and fail to meet the requirements.

The ideal solution for us would be to disable this behavior on the HTTP client.

Disable URLSession auto retry policy
 
 
Q