NSURLSession sending token back to server for getting data - ios

Question

I have app iPhone app which will be using API's call.
I made successful call with Username/Password with NSURLSession and receiving token from server....
NSString *username = #"admin";
NSString *password = #"test";
NSString *authString = [NSString stringWithFormat:#"%#:%#",
username,
password];
// 2 - convert authString to an NSData instance
NSData *authData = [authString dataUsingEncoding:NSUTF8StringEncoding];
// 3 - build the header string with base64 encoded data
NSString *authHeader = [NSString stringWithFormat: #"Basic %#",
[authData base64EncodedStringWithOptions:0]];
// 4 - create an NSURLSessionConfiguration instance
NSURLSessionConfiguration *sessionConfig =
[NSURLSessionConfiguration defaultSessionConfiguration];
// 5 - add custom headers, including the Authorization header
[sessionConfig setHTTPAdditionalHeaders:#{
#"Accept": #"application/json",
#"Authorization": authHeader
}
];
// 6 - create an NSURLSession instance
NSURLSession *session =
[NSURLSession sessionWithConfiguration:sessionConfig delegate:self
delegateQueue:nil];
// 7 - create an NSURLSessionDataTask instance
NSString *urlString = #"http://test.myserver.am/api/authentication/Login?username=admin&password=test";
NSURL *url = [NSURL URLWithString:urlString];
NSURLSessionDataTask *task = [session dataTaskWithURL:url
completionHandler:
^(NSData *_Nullable data, NSURLResponse *_Nullable response, NSError *_Nullable error) {
if (error)
{
// do something with the error
return;
}
NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *)response;
if (httpResponse.statusCode == 200)
{
arrTokenData = [NSJSONSerialization JSONObjectWithData:data options:kNilOptions error:&error];
[self getDomain];
} else {
// failure: do something else on failure
NSLog(#"httpResponse code: %#", [NSString stringWithFormat:#"%ld", (unsigned long)httpResponse.statusCode]);
NSLog(#"httpResponse head: %#", httpResponse.allHeaderFields);
return;
}
}];
// 8 - resume the task
[task resume];
Now I am using token received from server and making another call to get user Data......
[[UIApplication sharedApplication] setNetworkActivityIndicatorVisible:YES];
NSString *authValue = [arrTokenData valueForKey:#"Token"];
//Configure session with common header fields
NSURLSessionConfiguration *sessionConfiguration = [NSURLSessionConfiguration defaultSessionConfiguration];
sessionConfiguration.HTTPAdditionalHeaders = #{#"bearer": authValue};
NSURLSession *session = [NSURLSession sessionWithConfiguration:sessionConfiguration];
NSString *url = #"http://test.myserver.am/api/mobile/LookUps/getuserdata";
NSURLRequest *request = [NSURLRequest requestWithURL:[NSURL URLWithString:url]];
NSURLSessionDataTask *task = [session dataTaskWithRequest:request completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) {
[[UIApplication sharedApplication] setNetworkActivityIndicatorVisible:NO];
if (!error) {
NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *)response;
if (httpResponse.statusCode == 200)
{
NSDictionary *jsonData = [NSJSONSerialization JSONObjectWithData:data options:NSJSONReadingMutableContainers|NSJSONReadingAllowFragments error:nil];
//Process the data
}
}
}];
[task resume];
but I am receiving below status code and ....request is not getting successful....
httpResponse code: 500
httpResponse head: { "Cache-Control" = "no-cache"; "Content-Length" = 36; "Content-Type" = "application/json; charset=utf-8"; Date = "Thu, 06 Oct 2016 12:16:58 GMT"; Expires = "-1"; Pragma = "no-cache"; Server = "Microsoft-IIS/8.5"; "X-AspNet-Version" = "4.0.30319"; "X-Powered-By" = "ASP.NET"; }
****Please note the same APIs is working fine from another(xamarin APP) platform....**
I am using Objective-C.... IOS10
is there my sending token request is not proper....?
please help me out ..... I am stuck here from yesterday...

Answer 1

As has already been mentioned, I'm pretty sure it should be:
NSString *authValue = [NSString stringWithFormat:#"Bearer %#",
[arrTokenData valueForKey:#"Token"]];
sessionConfiguration.HTTPAdditionalHeaders = #{#"Authorization": authValue};
With that said, a 500 error is an internal server error, not an authentication error. It seems likely that the real problem has nothing to do with authentication, and that your request itself is malformed in some way or that there is a bug in the server-side code that you're somehow tickling.
Also, your code doesn't seem to be checking to see if the token is actually present in the response, unless you're doing that elsewhere.
I would start by checking to make sure the token is actually there, and if it is, enable whatever debugging you can enable on the server and look through the logs to try to figure out what is causing the 500 error on the server side. Chances are, the fix will be obvious once you see what's actually happening on the server side.

Answer 2

Firstly, you should not pass username / password in the ULR in the first authentication call, since you already pass it as a header field. Parameters in the URL are not secure. Sensitive data should always be passed by using POST instead of GET method. But this is not the problem.
Try set the header field in the second call like this:
NSString *authorizationHeader = [NSString stringWithFormat: #"Bearer %#", authValue];
[sessionConfig setHTTPAdditionalHeaders:#{
#"Accept": #"application/json",
#"Authorization": authorizationHeader
}
];
Basically, the auth header field should look like this (from postman):
image
Attention: I did not test / build my code!