Amy Blais aa47558a47 MM-70606: Fix Edit Server pre-auth secret save on HTTPS-redirecting servers (#10252) (#10290) ... * fix(MM-70606): send the pre-auth secret over HTTPS only and fix Edit Server save - sanitizeUrl: useHttp no longer downgrades an explicit https:// URL, so getServerUrlAfterRedirect keeps an HTTPS redirect target and strips its query string. - Send the pre-auth secret header only to https/wss URLs: REST client default headers, per-request headers, WebSocket, and the HEAD probe. The secret is still persisted for the server. - Edit Server: try HTTPS first, then fall back to HTTP (as Add Server does). - Edit Server: recreate and reconnect the WebSocket client after the secret changes, so the new secret is used without an app restart. * fix(MM-70606): keep the persisted pre-auth secret on token refresh over HTTP ClientTracking stores the secret in its own field. The token refresh in doFetchWithTracking reads that field instead of the request header, which is only set over TLS, so a refresh on an http:// server no longer resets the saved secret. * fix(MM-70606): clarify when the pre-auth secret header is removed * test(MM-70606): cover the pre-auth header guard in NetworkManager.createClient (cherry picked from commit c189ca9fdd) Co-authored-by: Felipe Martin <812088+fmartingr@users.noreply.github.com>		2026-10-30 14:09:40 +02:00
..
rest	MM-70606: Fix Edit Server pre-auth secret save on HTTPS-redirecting servers (#10252) (#10290)	2026-10-30 14:09:40 +02:00
websocket	MM-70606: Fix Edit Server pre-auth secret save on HTTPS-redirecting servers (#10252) (#10290)	2026-10-30 14:09:40 +02:00