mirror of
https://github.com/mattermost/mattermost-mobile.git
synced 2026-11-05 10:28:54 +00:00
aa47558a47
* fix(MM-70606): send the pre-auth secret over HTTPS only and fix Edit Server save
- sanitizeUrl: useHttp no longer downgrades an explicit https:// URL, so
getServerUrlAfterRedirect keeps an HTTPS redirect target and strips its
query string.
- Send the pre-auth secret header only to https/wss URLs: REST client
default headers, per-request headers, WebSocket, and the HEAD probe.
The secret is still persisted for the server.
- Edit Server: try HTTPS first, then fall back to HTTP (as Add Server does).
- Edit Server: recreate and reconnect the WebSocket client after the
secret changes, so the new secret is used without an app restart.
* fix(MM-70606): keep the persisted pre-auth secret on token refresh over HTTP
ClientTracking stores the secret in its own field. The token refresh in
doFetchWithTracking reads that field instead of the request header, which
is only set over TLS, so a refresh on an http:// server no longer resets
the saved secret.
* fix(MM-70606): clarify when the pre-auth secret header is removed
* test(MM-70606): cover the pre-auth header guard in NetworkManager.createClient
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| index.test.ts | ||
| index.ts | ||
| latin_map.ts | ||
| latinise.ts | ||
| links.test.ts | ||
| links.ts | ||
| path.ts | ||
| test.ts | ||