urlSession(_:task:didReceive:completionHandler:) does not fire if second request sent within 30 seconds

Greetings,

I'm seeing that authentication challenge is not being issued for client certificate secured URL for second reqeust, if it is being sent within 30 seconds of the first request. Here is the code and steps I'm following,

1. Create a data task from a URL session for a client certificate secured URL.

2. Resume the data task.

3. The authenticateion challenge of type `NSURLAuthenticationMethodClientCertificate` is being issed.

4. Perform default handling on the challenge.

5. The task will finish with an error.

6. Before 30 seconds elapses, preform step 1 and 2 again.

7. The steps 3 and 4 gets skiped and finish the data task as per step 5.

class ViewController: UIViewController, URLSessionTaskDelegate, URLSessionDataDelegate {

    var dataTask: URLSessionDataTask?
    var urlSession: URLSession?
    
    override func viewDidLoad() {
        super.viewDidLoad()
        let sessionConfiguration = URLSessionConfiguration.default
        urlSession = Foundation.URLSession(configuration: sessionConfiguration, delegate: self, delegateQueue: OperationQueue.main)
    }

    @IBAction func buttonAction(_ sender: Any) {
        let url = URL(string: “Client Certificate Secured URL“)! // ClientCertificate
        //let url = URL(string: “NTLM Secured URL")! // NTLM
        dataTask = urlSession?.dataTask(with: url)
        dataTask?.resume()
    }
    
    func urlSession(_ session: URLSession, task: URLSessionTask, didReceive challenge: URLAuthenticationChallenge, completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
        guard challenge.previousFailureCount == 0 else {
            challenge.sender?.cancel(challenge)
            completionHandler(.cancelAuthenticationChallenge, nil)
            return
        }
        
        if challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodServerTrust {
            if let trust = challenge.protectionSpace.serverTrust{
                var trustResult: SecTrustResultType = SecTrustResultType(rawValue: 0)!
                SecTrustEvaluate(trust, &trustResult)
                
                if trustResult == .unspecified || trustResult == .proceed {
                    let credential = URLCredential(trust: trust)
                    completionHandler(.useCredential, credential)
                }
            }
        }
        else if challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodClientCertificate {
            print("protectionSpace: \(challenge.protectionSpace)")
            completionHandler(.performDefaultHandling, nil)
        }
        else {
            print("protectionSpace: \(challenge.protectionSpace)")
            completionHandler(.performDefaultHandling, nil)
        }
    }
    
    func urlSession(_ session: URLSession, dataTask: URLSessionDataTask, didReceive data: Data) {
        let dataString = String(data: data, encoding: .utf8)
        print("dataString: \(String(describing: dataString))")
    }
}

Here are the important things I noticed,

1. If the URL is NTLM secured then there is no issue. The authentication challenge is being issued even if requests are being sent within 30 seconds.

2. Sending request after 30 seconds the authentication challenge is being issued correctly.

3. While debugging I noticed the `URLSessionConfiguration` has an internal property, `_connectionCachePurgeTimeout` which is set to `30`. Is this coming into picture here? I don't see anyother timeout interval set to `30`

Is this a bug or am I missing something?

Sorry, at this time, I do not have public URLs available for you to test this.

Appreciate any help! Thank you!

Regards,

Nimesh