Sources/LCEssentials/Classes/LCEssentials+API.swift

@@ -194,14 +194,31 @@ public struct API {
                 API.requestLOG(method: method, request: request)
             }
             
-            let session = URLSession(
-                configuration: .default,
-                delegate: URLSessionDelegateHandler(
-                    certData: API.certData,
-                    password: API.certPassword
-                ),
-                delegateQueue: nil
-            )
+            // Only spin up a dedicated session (with its own @MainActor
+            // delegate hop for every TLS/auth challenge) when client
+            // certificate auth is actually configured. Creating one of
+            // these per request unconditionally — and never invalidating
+            // it — could stall the async challenge callback waiting on an
+            // already-busy MainActor, hanging the request indefinitely with
+            // no timeout or error ever surfacing. The common case (no
+            // client cert) uses the shared session, which has none of this
+            // risk and is what URLSession is designed to be reused as.
+            let usesCertSession = API.certData != nil
+            let session: URLSession = usesCertSession
+                ? URLSession(
+                    configuration: .default,
+                    delegate: URLSessionDelegateHandler(
+                        certData: API.certData,
+                        password: API.certPassword
+                    ),
+                    delegateQueue: nil
+                )
+                : URLSession.shared
+            defer {
+                if usesCertSession {
+                    session.finishTasksAndInvalidate()
+                }
+            }
             do {
                 let (data, response) = try await session.data(for: request)