We are using the older HTTP/1.1 protocol, but with servers that support TLS 1.2. The version of HTTP shouldn't matter since the TLS (formerly SSL) session is established before the HTTP layer of the protocol starts.
There are some security concerns about ticket-based session resumption in TLS 1.2 (search the web for "we-need-to-talk-about-session-tickets") that appear to be fixed in TLS 1.3. So perhaps the issue is that the Apple security team decided to not support ticket-based session resumption in TLS 1.2, and URLSession does not yet support TLS 1.3?
** Is there any way you could check with them? **
I will also try testing our app against a TLS 1.3 server to see if ticket-based resumption works there.
I really appreciate your help!
References I have found that do not quite answer my question:
https://support.apple.com/guide/security/tls-security-sec100a75d12/web
Topic:
App & System Services
SubTopic:
Networking
Tags: