Session-Based Authentication with Swift: Managing User Sessions and Accessing Protected Resources

Introduction to Session-Based Authentication

Welcome to this lesson on Session-Based Authentication . In the previous lesson, we delved into API authentication using API keys, focusing on how these keys act as a passcode for gaining access to protected endpoints. Here, we take a step further and explore session-based authentication, a method where the server maintains user session information, providing a stateful experience. Unlike API keys, which are stateless, session-based authentication provides a user-friendly way to manage active sessions, track user interactions, and facilitate access to resources. In stateless authentication (such as API keys), every request must contain the necessary credentials, and the server does not retain any information about previous interactions. In contrast, session-based authentication creates and maintains state between requests. This means that once a user logs in, the server assigns a session ID, which the client must include in subsequent requests. The session ID acts as a temporary authentication token, allowing users to stay logged in without re-entering credentials. By the end of this lesson, you will be capable of signing up, logging in, accessing protected resources, and logging out using session-based authentication.

Understanding Session-Based Authentication

Session-based authentication is a process that allows users to stay logged into a system as they interact with different endpoints in an application. Whether you are using a web browser or a client like a Swift application to interact with a RESTful API, session-based authentication involves maintaining user session information on the server, creating a stateful experience. When you log in to a RESTful API using your Swift client, the server starts a "session" for you. This session is like a temporary ID card that validates your identity during your interactions with the API. A critical part of this process involves a "cookie," which is a small piece of data sent from the server and stored by your client. In the context of a Swift-based client: Session Creation : After logging in by sending a POST request with your username and password, the server creates a unique session ID, often returned in a cookie. Ongoing Requests : Your Swift client, with the help of URLSession, can manage cookies automatically, including the session ID in subsequent requests to the API. This allows the server to recognize the session without needing to re-enter your credentials. Session Termination : When your client logs out by sending a logout request, the server invalidates the session, stopping further requests with the old session ID from succeeding, safeguarding your session integrity. By using URLSession in Swift, you can manage cookies and session data seamlessly, enabling effective interaction with RESTful API endpoints while maintaining user state securely. Cookies are small pieces of data stored on the client side and sent to the server with each request. In session-based authentication, the server typically returns a Set-Cookie header containing a session ID when a user logs in. This header instructs the client to store the session ID as a cookie and send it back in subsequent requests.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Swift

import Foundation
#if canImport(FoundationNetworking)
import FoundationNetworking
#endif

// Create a URLSession configuration that handles cookies
let sessionConfig = URLSessionConfiguration.default
sessionConfig.httpCookieAcceptPolicy = .always
sessionConfig.httpShouldSetCookies = true

// Create a URLSession with the configuration
let session = URLSession(configuration: sessionConfig)

// Base URL for the API
let baseURL = URL(string: "http://localhost:8000")!

// Create a DispatchGroup to manage asynchronous tasks
let dispatchGroup = DispatchGroup()

Swift

dispatchGroup.enter()
let authDetails: [String: Any] = [
    "username": "testuser",
    "password": "testpass123"
]
let jsonData = try! JSONSerialization.data(withJSONObject: authDetails)
var request = URLRequest(url: baseURL.appendingPathComponent("/auth/signup"))
request.httpMethod = "POST"
request.setValue("application/json", forHTTPHeaderField: "Content-Type")
request.httpBody = jsonData

let task = session.dataTask(with: request) { data, response, error in
    defer { dispatchGroup.leave() }
    if let error = error {
        print("An error occurred: \(error)")
        return
    }
    
    guard let httpResponse = response as? HTTPURLResponse, (200...299).contains(httpResponse.statusCode) else {
        print("Server error!")
        return
    }
    
    if let data = data, let jsonResponse = try? JSONSerialization.jsonObject(with: data) as? [String: Any] {
        print("Signed up successfully!")
        print(jsonResponse)
    }
}
task.resume()

text

Signed up successfully!
{"message": "Signup successful. Please log in to continue."}

Swift

dispatchGroup.enter()
var loginRequest = URLRequest(url: baseURL.appendingPathComponent("/auth/login"))
loginRequest.httpMethod = "POST"
loginRequest.setValue("application/json", forHTTPHeaderField: "Content-Type")
loginRequest.httpBody = jsonData

let loginTask = session.dataTask(with: loginRequest) { data, response, error in
    defer { dispatchGroup.leave() }
    if let error = error {
        print("An error occurred: \(error)")
        return
    }
    
    guard let httpResponse = response as? HTTPURLResponse, (200...299).contains(httpResponse.statusCode) else {
        print("Server error!")
        return
    }
    
    if let data = data, let jsonResponse = try? JSONSerialization.jsonObject(with: data) as? [String: Any] {
        print("Logged in successfully!")
        print(jsonResponse)
        
        if let cookies = HTTPCookieStorage.shared.cookies {
            for cookie in cookies {
                if cookie.name == "session" {
                    print("Session ID: \(cookie.value)")
                }
            }
        }
    }
}
loginTask.resume()

text

Logged in successfully!
{"message": "Login successful"}

Session ID: eyJhdXRoZW50aWNhdGVkIjp0cnVlLCJ1c2VybmFtZSI6InRlc3R1c2VyMjIyIn0.Z5JFJQ.sF2NX5wOgSF5GVqEmuS2YAawIWM

Swift

dispatchGroup.enter()
var todosRequest = URLRequest(url: baseURL.appendingPathComponent("/todos"))
todosRequest.httpMethod = "GET"

let todosTask = session.dataTask(with: todosRequest) { data, response, error in
    defer { dispatchGroup.leave() }
    if let error = error {
        print("An error occurred: \(error)")
        return
    }
    
    guard let httpResponse = response as? HTTPURLResponse, (200...299).contains(httpResponse.statusCode) else {
        print("Server error!")
        return
    }
    
    if let data = data, let jsonResponse = try? JSONSerialization.jsonObject(with: data) as? [[String: Any]] {
        print("Accessed todos successfully!")
        print(jsonResponse)
    }
}
todosTask.resume()

text

Accessed todos successfully!
[{"description": "Milk, eggs, bread, and coffee", "done": false, "id": 1, "title": "Buy groceries"}, {"description": "Check in and catch up", "done": true, "id": 2, "title": "Call mom"}, {"description": "Summarize Q4 performance metrics", "done": false, "id": 3, "title": "Finish project report"}, {"description": "30 minutes of cardio", "done": true, "id": 4, "title": "Workout"}]

Swift

dispatchGroup.enter()
var logoutRequest = URLRequest(url: baseURL.appendingPathComponent("/auth/logout"))
logoutRequest.httpMethod = "POST"

let logoutTask = session.dataTask(with: logoutRequest) { data, response, error in
    defer { dispatchGroup.leave() }
    if let error = error {
        print("An error occurred: \(error)")
        return
    }
    
    guard let httpResponse = response as? HTTPURLResponse, (200...299).contains(httpResponse.statusCode) else {
        print("Server error!")
        return
    }
    
    if let data = data, let jsonResponse = try? JSONSerialization.jsonObject(with: data) as? [String: Any] {
        print("Logged out successfully!")
        print(jsonResponse)
    }
}
logoutTask.resume()

// Wait for all tasks to complete
dispatchGroup.wait()

text

Logged out successfully!
{"message": "Logout successful"}

text

An HTTP error occurred: 401 Client Error: UNAUTHORIZED for url: http://localhost:8000/todos
Error: Valid session required

Introduction to Session-Based Authentication

Understanding Session-Based Authentication

Join the 1M+ learners on CodeSignal

Managing Sessions with URLSession

Step 1: Signing Up

Step 2: Logging In

Step 3: Accessing Protected Endpoints

Step 4: Ending the Session with Logging Out

Attempting to Access Protected Endpoints After Logout

Summary and Preparation for Practice