Ti.Network.createHTTPClient 401 without credentials: retry behavior?

1. Does the client retry a 401?

In the current stable Titanium SDK, Ti.Network.createHTTPClient does not automatically resend a request after receiving a 401 when no Authorization header is supplied. The HTTP client simply delivers the 401 response to the callbacks you registered.

2. Is there a setting or callback that enables automatic retry?

No SDK option or callback can turn on a retry for authentication failures. The only way to retry is to detect the 401 in your code (via onload or onerror), add the appropriate Authorization header, and call send() again.

3. Do iOS and Android behave the same?

Both platforms use the same Titanium wrapper logic. Neither wrapper performs a hidden retry, although the timing of the onload versus onerror callback may differ slightly between the two OSes. In practice, you will see exactly one request from the app on each platform.

How to verify the behavior in a clean environment

1. Set up a basic‑auth protected endpoint that logs incoming requests (e.g., using a simple Node/Express server with express-basic-auth).
2. Create a minimal Titanium app that calls createHTTPClient without an Authorization header:

var xhr = Ti.Network.createHTTPClient({
      onload: function(e) {
          Ti.API.info('onload status: ' + e.source.status);
      },
      onerror: function(e) {
          Ti.API.info('onerror: ' + e.error + ', status: ' + e.source.status);
      }
  });
  xhr.open('GET', 'https://your‑server.com/protected');
  xhr.send();

3. Run the app on an iOS simulator and an Android emulator/device.
4. Check the server logs. You should see only one request per run and a 401 response.
5. Confirm that no second request is issued automatically.

Implementing a manual retry

Once you receive the 401, build the Authorization header and resend:

function retryWithAuth() {
    var auth = 'Basic ' + Ti.Utils.base64encode('user:pass');
    xhr.setRequestHeader('Authorization', auth);
    xhr.send();
}

Call retryWithAuth() from within your onload or onerror handler when the status is 401.

Missing Diagnostic Detail

To fine‑tune your retry logic, it helps to know whether the server logs show a second request after the 401. If you observe a second request, that would indicate a platform‑specific retry you are unaware of.