title: Using HTTP Digest Authentication on the iPhone
body: <p>I have an app that communicates with a server that uses HTTP Digest authentication.</p>
  
  <p>It seems to me that the 'session' management within the iPhone is pretty "black box" to us developers. Is it true that we can't see how the framework handles / persists http sessions?</p>
  
  <p>If I'm just being dim here, would someone care to explain how to probably handle HTTP Digest authentication on the iPhone?</p>
  
  <p>My basic run through is:</p>
  
  <ul>
  <li>Make a request to a secured url</li>
  <li>Server sends a 401</li>
  <li>client creates and persists a credential, and passes it back to the server</li>
  <li>server verifies credential, completes request if verified, sends another 401 if not.</li>
  <li>make a subsequent request to secure url</li>
  <li>server requests authorisation again........</li>
  </ul>
  
  <p>This works for single requests, but if I make additional, subsequent requests, the server requests authorisation again. The server has persisted a session for the particular user, but the iPhone isn't making a request within the same session for some reason... Therefore, the server has to throw out the authentication object and create a new one each time the client makes a request to a secured url.</p>
  
  <p>I'm sure this isn't correct behaviour.</p>
  
  <p>If we look at how a browser behaves in this situation:</p>
  
  <ul>
  <li>Browser requests data from secure url</li>
  <li>server sends 401</li>
  <li>browser prompts user for credential, persists it, passes it to server</li>
  <li>server verifies credential, returning data if verified, sends another 401 if not.</li>
  <li>subsequent requests made to secure urls are not prompted for credentials because the browser manages the session.</li>
  </ul>
  
  <p>I'm creating the NSURLCredential and persisting it within the NSURLCrendtialStorage.
  Then when the app receives the 'didReceiveAuthenticationChallenge' I retrieve the credential from the storage and pass it back, creating the credential if it doesn't exist (on the first request).</p>
  
  <p>Any help would be greatly appreciated.
  Thanks.</p>