Swift 4 Basic认证：iOS应用REST API管理器类技术咨询

Hey there! Let's work through getting your APIManager set up with proper Basic Authentication in Swift 4. I'll walk you through fixing your existing code, implementing two solid approaches, and verifying everything works as expected.

First, let's address the syntax issues in your original snippet, then implement two common Basic Auth patterns depending on your needs:

Approach 1: Handle Auth Challenges via URLSessionDelegate #

Great for scenarios where you need to persist credentials or handle repeated authentication prompts:

import UIKit

class APIManager: NSObject, URLSessionDelegate {
    let baseURL = "http://example.com/api/"
    static let sharedInstance = APIManager()
    private let session: URLSession
    
    // Private init to enforce singleton pattern
    private override init() {
        let config = URLSessionConfiguration.default
        // Initialize session with self as delegate to catch auth challenges
        session = URLSession(configuration: config, delegate: self, delegateQueue: nil)
        super.init()
    }
    
    // Handle HTTP Basic Auth challenges
    func urlSession(_ session: URLSession, didReceive challenge: URLAuthenticationChallenge, completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
        // Only handle HTTP Basic Auth
        guard challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodHTTPBasic else {
            completionHandler(.performDefaultHandling, nil)
            return
        }
        
        // Create and pass the credential
        let credential = URLCredential(user: "user", password: "password", persistence: .forSession)
        completionHandler(.useCredential, credential)
    }
    
    // Example GET request method
    func fetchData(endpoint: String, completion: @escaping (Data?, Error?) -> Void) {
        guard let url = URL(string: baseURL + endpoint) else {
            let invalidURLError = NSError(domain: "APIManager", code: -1, userInfo: [NSLocalizedDescriptionKey: "Invalid endpoint URL"])
            completion(nil, invalidURLError)
            return
        }
        
        let task = session.dataTask(with: url) { data, _, error in
            completion(data, error)
        }
        task.resume()
    }
}

Key Fixes & Notes: #

• Removed the extra comma in your class definition (class APIManager: NSObject, { → class APIManager: NSObject, URLSessionDelegate {)
• Added a proper singleton setup with a private initializer
• Implemented the URLSessionDelegate method to handle Basic Auth challenges explicitly
• Added a reusable GET request wrapper for easy API calls

Approach 2: Add Auth Directly to Request Headers #

A simpler approach for one-off requests where you don't need to handle challenge prompts:

import UIKit

class APIManager: NSObject {
    let baseURL = "http://example.com/api/"
    static let sharedInstance = APIManager()
    private let session = URLSession.shared
    
    private override init() { super.init() }
    
    // Helper to generate Basic Auth header string
    private func basicAuthHeader(username: String, password: String) -> String? {
        let credentialString = "\(username):\(password)"
        guard let credentialData = credentialString.data(using: .utf8) else {
            return nil
        }
        return "Basic \(credentialData.base64EncodedString())"
    }
    
    // Example GET request with inline auth
    func fetchData(endpoint: String, completion: @escaping (Data?, Error?) -> Void) {
        guard let url = URL(string: baseURL + endpoint) else {
            let invalidURLError = NSError(domain: "APIManager", code: -1, userInfo: [NSLocalizedDescriptionKey: "Invalid endpoint URL"])
            completion(nil, invalidURLError)
            return
        }
        
        var request = URLRequest(url: url)
        // Inject Basic Auth header
        if let authHeader = basicAuthHeader(username: "user", password: "password") {
            request.setValue(authHeader, forHTTPHeaderField: "Authorization")
        }
        
        let task = session.dataTask(with: request) { data, _, error in
            completion(data, error)
        }
        task.resume()
    }
}

Key Notes: #

• Encodes your username/password into the Base64 string required for Basic Auth
• Adds the auth header directly to the request, no delegate setup needed
• Cleaner for simple use cases where you know the auth is required upfront

Here are 3 reliable ways to confirm your Basic Auth is functioning:

• Check Status Codes in Code:
  Add a print statement in your request completion handler to check the HTTP status code:

  let task = session.dataTask(with: request) { data, response, error in
      if let httpResponse = response as? HTTPURLResponse {
          print("Auth Test Status Code: \(httpResponse.statusCode)")
          // 200 = Success; 401 = Auth failed (bad credentials/missing header)
      }
      completion(data, error)
  }
  

• Use Xcode's Network Inspector:
  Run your app, trigger the API request, then open the Debug Navigator (bug icon on left) → select Network. Find your request, check the Request Headers tab to confirm the Authorization header is present (for Approach 2) or look for auth challenge logs (for Approach 1).

• Test with Charles Proxy:
  Set up Charles to proxy your iOS device's network traffic. You can inspect the full request/response details, modify credentials to test failure cases, and confirm the auth flow works as expected.

• Never hardcode credentials: Store usernames/passwords in the Keychain or a secure config file, not directly in your code.
• Use HTTPS: Switch your API to HTTPS (update baseURL to https://example.com/api/ and adjust the URLProtectionSpace port to 443 if using Approach 1) to avoid sending credentials in plaintext.

内容的提问来源于stack exchange，提问作者clementb49