AFNetworking 2.0 - unexpected NSURLErrorDomain error -1012

Question

We ran into the following issue with our app that uses AFNetworking 2.0. When using AFHTTPRequestOperationManager's GET method, we got an error NSURLErrorDomain code -1012. The request used HTTPS and the server does not require user authentication. The request never reached the server by the way.

We have run several tests and this is the first time the error was produced and we are wondering how this error can get produced because it does not seem relevant.

Setup of AFHTTPRequestOperationManager :

httpOperationManager = [[AFHTTPRequestOperationManager alloc] initWithBaseURL: 
        [NSURL URLWithString: HTTPS_URL)]];

httpOperationManager.responseSerializer = 
        [AFXMLParserResponseSerializer serializer];

[[AFNetworkActivityIndicatorManager sharedManager] setEnabled: YES];

GET REQUEST

AFHTTPRequestOperation *op =[httpOperationManager GET: 
        [NSString stringWithFormat:SOME_PATH] 
        parameters:nil 
        success:^(AFHTTPRequestOperation *operation, id responseObject) { 
            //code to setup NSXMLParser ...
        } 
        failure: ^(AFHTTPRequestOperation *operation, NSError *error) {
            NSLog(@"error %@", [error localizedDescription]);
        }];

Solution 1

I think you already solved the problem, but if you are trying to authenticate in a server that doesn't have a valid certificate you have to set YES for property allowInvalidCertificates in your AFHTTPRequestOperationManager object:

[yourManager.requestSerializer setAuthorizationHeaderFieldWithUsername:@"your_username" password:@"your_password"];
[yourManager.securityPolicy setAllowInvalidCertificates:YES];

Also, as @a1phanumeric said, it can be necessary to include this line:

[yourManager.securityPolicy setValidatesDomainName:NO];

Cheers.

Solution 2

NSURLErrorDomain -1012 is NSURLErrorUserCancelledAuthentication. (See the error code list and search for -1012.)

You state, "the server does not require user authentication". But this error would not be called if that were true.

Possible causes:

1. Your server is erroneously requesting authorization (a server bug)
2. The URL formed with HTTPS_URL and SOME_PATH is not what you expect, and some other server is requesting authorization
3. Some intermediary (like a proxy server, or an access point) is requiring authorization.

Some debugging tips:

• Set breakpoints inside the AFNetworking implementation to see which URL is being hit
• Configure AFHTTPRequestOperationLogger so you can see the actual request body and response in your console log
• Make the same request with curl or Advanced Rest Client and observe the server's response

Side note: I think [NSString stringWithFormat:SOME_PATH] is pointless - why not just use SOME_PATH?

Comments

[Warlord]

Well then, what is the question?

[Charis]

My question is what caused the -1012 error since the server does not require user authentication and our code just performs the request without cancelling it. If it's AFNetworking that cancelled the request, we would like to understand why and how to deal with it.

[Charis]

It's not a server/proxy issue because we took a tcp dump while we were getting the error and the request never reached the server. "Close notify" was called on the client side. We only had this problem once on a specific device, it's not sth that we can reproduce (at least not easily). We restarted the device but the error kept appearing for the same request, then we uninstalled and reinstalled the app and the error disappeared. We are worried of what might have caused it since it did not reappear in that device or any other. thanks. (SOME_PATH is actually a check for test/production url)

[Charis]

I got the same error again today. By the way the device was on WiFi. When I switch to 3G again the request is not performed however there is no error so the failure block is not called. I only see these lines in the console of the device "<Error>: __hid_dispatch_pthread_root_queue_create_block_invoke: specific=0x1780b5a80 pthread_self=0x10631c000".

[Charis]

Another piece of info is that we are getting these errors on a device with iOS 7.1. Requesting the same https URL from Safari shows a popup that the server's identity cannot be verified. Pressing continue does not actually perform the request.

[Charis]

after some hours of investigation it turns out that we had install an intermediate certificate to our server because the lack of it, was causing the certificate validation to fail with a kSecTrustResultRecoverableTrustFailure error. On iOS 7 this is causing a Close notify on the connection with the server, which is delivered as the NSURLErrorDomain code -1012. AFter installing the intermediate certificate following the instruction of the CA authority, the error is no longer produced.

[Charis]

thanks. Yes we did solve the problem server-side by adding the intermediate certificates. It was the more secure thing to do, rather than allowing invalid certificates.

[Ríomhaire]

Anyone using the free certs from startssl.com will run into this problem. Code -999.

[a1phanumeric]

An update to this - I also had to add [operationManager.securityPolicy setValidatesDomainName:NO]; to get this to work.

[villapossu]

Thanks so much for the validatesDomainName addition. We were playing with a pure IP address here and it very much required this in order to work.

[Pramod Tapaniya]

@Charis How to add intermediate certificate. You say about ssl ?