MugunthKumar/MKNetworkKit — Issue #35: Authentication cached somewhere
Author: morgler
Created: 2012-01-18 15:01:10+00:00
State: open

I try to connect to an SSL and Basic Auth secured web service. Connecting works, but it seems to use some earlier stored/cached credentials. When I entered other or simply wrong credentials, I can still connect.

Here's my first attempt using the HTTP Auth header:
```
MKNetworkOperation *op = [self operationWithPath:path params:nil httpMethod:@"GET" ssl:YES];
[op setUsername:username password:password basicAuth:YES];
```
I also tried to respond to an auth challenge with my custom handler:
```
MKNetworkOperation *op = [self operationWithPath:path params:nil httpMethod:@"GET" ssl:YES];
op.authHandler = ^(NSURLAuthenticationChallenge *challenge) {
NSLog(@">>>>>> receiving challenge => %@, %@", username, password);
NSURLCredential *credential = [NSURLCredential credentialWithUser:username password:password persistence:NSURLCredentialPersistenceNone];
[challenge.sender useCredential:credential forAuthenticationChallenge:challenge];
};
```
In both cases, I can pass wrong username/password and it still connects! In the second case, the custom handler is never called.

I could also see the MKNetworkOperation receive an authentication challenge (in spite of sending my Basic HTTP Auth header). Inside the method `(void)connection:(NSURLConnection *)connection willSendRequestForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge` it takes the branch

```
else if (challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodServerTrust)
...
```

I just can't delete the old credentials (that were supposedly stored on my first ever connect) and/or pass different credentials. Maybe I just misunderstood something.