Open Radar

 
Summary:
NSURLSession's dataTaskWithRequest:completionHandler: leaks when performing a request that invokes URLSession:didReceiveChallenge:completionHandler: for client certificate authentication. A delegate does not even need to be setup to handle the challenge, as seen in the following example. There are no issues with actually getting client authentication working, but the leaks are alarming for long running processes.

Changing the URL to another site that does not require client authentication results in no leaks.

  NSURLRequest *req = [NSURLRequest requestWithURL:[NSURL URLWithString:@"https://clientauth.exaple.com"]];
  NSURLSession *session = [NSURLSession sessionWithConfiguration:[NSURLSessionConfiguration ephemeralSessionConfiguration]];
  [[session dataTaskWithRequest:req completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) {
    NSLog(@"%@", response);
  }] resume];
  [session finishTasksAndInvalidate];

Steps to Reproduce:
1. Run the attached test app through Instruments.

Expected Results:
There should be no leaks.

Actual Results:
The test program leaks:
Leaked Object	#	Address	Size	Responsible Library	Responsible Frame
Malloc 64 Bytes	1	0x600000269940	64 Bytes	Security	DefaultAllocator::malloc(unsigned long)
Malloc 16 Bytes	1	0x600000010430	16 Bytes	Security	DefaultAllocator::malloc(unsigned long)