Daily iOS
Back to question bank
Networking

URLSession redirect handling

After login, a request sent with an Authorization header gets a 302 from the server to a different host, and then a 401 comes back. Why did that 401 happen?

How would an interviewer hear this answer? You'll see whether they'd move on, dig in, or say no, and which sentences would trip you up. Your score doesn't change.
See the short answer

URLSession follows 3xx automatically, and when the redirect goes to a different host it strips sensitive headers like Authorization for security and turns a 303 into a GET, so the new host received a request with no auth header and answered 401.

Share a question