Pages 194 to 195
Q13. [Senior] “Where does the auth token live, and what happens on a 401 in the middle of a sync?”
Model answer
“Access and refresh tokens live in the Keychain, never UserDefaults, which is unencrypted on disk, behind a small TokenStore so only one type touches storage. On a 401, the network client’s authenticator refreshes the token single-flight: the first 401 triggers the refresh, concurrent requests that also got 401s wait on the same refresh instead of firing their own, then everything retries with the new token. Mid-sync specifically: the sync queue pauses rather than marking its items failed, waits for the refresh, and resumes where it left off, the user’s queued writes are never lost to an auth hiccup. Only if the refresh itself fails do we sign the user out, keeping local data so a re-login can resume the sync. For a banking-grade app I’d add certificate pinning, with the caveat that pin rotation has to be planned or old app versions break.”
Why it works
Keychain, single-flight refresh, pause-and-resume sync, sign-out only on refresh failure, and the pinning trade-off, the complete chain, each step justified.
