I have gone through this link
Why is a HTTPS NSURLSession connection only challenged once per domain?
In case of NSURLConnection, didReceiveChallenge was not called for every request. In case of NSURLSession, it is called for every request. How can they behave differently if its dependent only on TLS session cache