Background Assets Extension and DeviceCheck

Question

sebastianlivoni OP

Created Apr ’25

Replies 2

Boosts 0

Participants 2

Hi, I have some questions regarding the Background Assets Extension and DeviceCheck framework.

Goal: Ensure that only users who have purchased the app can access the server's API without any user authentication using for example DeviceCheck framework and within a Background Assets Extension.

My app relies on external assets, which I'm loading using the Background Assets Extension. I'm trying to determine if it's possible to obtain a challenge from the server and send a DeviceCheck assertion during this process within the Background Assets Extension.

So far, I only receive session-wide authentication challenges—specifically NSURLAuthenticationMethodServerTrust in the Background Assets Extensio. I’ve tested with Basic Auth (NSURLAuthenticationMethodHTTPBasic) just for experimentation, but the delegate

func backgroundDownload(
    _ download: BADownload,
    didReceive challenge: URLAuthenticationChallenge
) async -> (URLSession.AuthChallengeDisposition, URLCredential?)

is never called with that authentication method. It seems task-specific challenges aren't coming through at all.

Also, while the DCAppAttestService API appears to be available on macOS, DCAppAttestService.isSupported always returns false (in my testing), which suggests it's not actually supported on macOS. Can anyone confirm if that’s expected behavior?

Boost

Answer 1

Systems Engineer OP

Apple

Apr ’25

The DeviceCheck framework is not currently supported from within the extension. Please file a Developer Feedback request for this and we'll consider this.

For the Authentication Challenge issue, all challenges should be forwarded to either your extension or your BADownloadManager's delegate if the app is running. If this isn't behaving properly please reproduce the issue, and then take a sysdiagnose and file a second feedback report and I'll be happy to have a look.

0

Answer 2

sebastianlivoni OP

May ’25

When I download the example from Apple's documentation and add print("challenge: \(challenge.protectionSpace.authenticationMethod)") inside the func download(_ download: BADownload, didReceive challenge: URLAuthenticationChallenge) async method in SessionManager.swift, the output always shows NSURLAuthenticationMethodServerTrust. I never see NSURLAuthenticationMethodDefault.

0