Fix Android image loads by attaching auth headers by nickmisasi · Pull Request #9554 · mattermost/mattermost-mobile

nickmisasi · 2026-02-26T23:51:09Z

Summary

Fixes an Android regression where authenticated image endpoints (profile avatars and attachment images) were requested without auth headers, causing 401 responses and failed rendering.
Updates the shared ExpoImage wrapper in app/components/expo_image/index.tsx to attach server GET request headers from NetworkManager only for first-party API URLs (<server>/api/v4/...).
Applies the same treatment to both source and placeholder image objects, so progressive image flows remain authenticated throughout.

Why this is necessary

The mobile app renders most avatars and attachments through expo-image (Glide on Android).
These image URLs point to authenticated API resources (/api/v4/users/.../image, /api/v4/files/...) that require session auth.
On Android release flows (especially visible after Microsoft SSO login), those image fetches could occur without request auth context, resulting in 401 and blurred/empty images.
The fix ensures these API image requests are explicitly authenticated using the same header strategy as the app’s network client.

Implementation details

Adds shouldAttachServerAuthHeaders(uri, serverUrl) to strictly scope header injection to same-server API URLs.
Reads existing auth headers via NetworkManager.getClient(serverUrl).getRequestHeaders('GET').
Merges headers as {...requestHeaders, ...existingHeaders} to preserve any per-source header overrides.
Keeps existing cacheKey/cachePath behavior unchanged to avoid altering image caching semantics.

Risk and scope

Change is limited to one shared wrapper file: app/components/expo_image/index.tsx.
External/non-API image URLs are not modified, preventing auth header leakage to third-party hosts.
iOS behavior remains functionally unchanged because header attachment is conditioned by URL matching and existing source metadata.

Test plan

Reproduced issue on Android release scenario with Microsoft login (profile + attachment images failing).
Confirmed runtime failures were 401 for image fetches.
Verified fixed behavior after header attachment: images render as expected.
Verified no linter errors in touched file.

Made with Cursor

NONE

mm-cloud-bot · 2026-02-26T23:51:12Z

@nickmisasi: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Details

I understand the commands that are listed here

nickmisasi · 2026-02-26T23:59:48Z

@coderabbitai review

Copilot

Pull request overview

Fixes an Android regression where expo-image requests to authenticated Mattermost API image endpoints were made without auth headers (leading to 401 and broken rendering), by injecting GET auth headers for first-party /api/v4/... image URLs inside the shared ExpoImage wrapper.

Changes:

Add NetworkManager-derived GET request headers into source.headers for server API image URLs.
Apply the same header injection to placeholder to keep progressive/placeholder loading authenticated.
Add shouldAttachServerAuthHeaders to scope header injection to first-party API URLs.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

app/components/expo_image/index.tsx

nickmisasi · 2026-02-27T00:06:12Z

@cursor can you fix the snapshots on this pr?

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

github-actions · 2026-02-27T00:41:04Z

Coverage Comparison Report

Generated on February 27, 2026 at 02:10:13 UTC

+-----------------+------------+------------+-----------+
| Metric          | Main       | This PR    | Diff      |
+-----------------+------------+------------+-----------+
| Lines           |     85.50% |     85.50% |     0.00% |
| Statements      |     85.37% |     85.37% |     0.00% |
| Branches        |     72.52% |     72.52% |     0.00% |
| Functions       |     84.43% |     84.43% |     0.00% |
+-----------------+------------+------------+-----------+
| Total           |     81.95% |     81.95% |     0.00% |
+-----------------+------------+------------+-----------+

nickmisasi · 2026-02-27T01:18:03Z

/update-branch

The expo_image/index.tsx hunks in 9325-full.diff were generated before the NetworkManager/header-handling code was added to ExpoImage. The stale context lines caused patch's fuzzy matching to apply ExpoImage hunks to ExpoImageBackground instead, then ExpoImageBackground hunks failed because those sections were already modified. Regenerated the expo_image diff hunks to match the current file state with proper context lines for both ExpoImage (with header handling) and ExpoImageBackground components. https://claude.ai/code/session_01SGXWQzxrcPpWsq2YrjoUwd Co-authored-by: Claude <noreply@anthropic.com>

amyblais · 2026-02-27T02:46:23Z

/cherry-pick release-2.37

mattermost-build · 2026-02-27T02:46:25Z

Cherry pick is scheduled.

amyblais · 2026-02-27T02:46:32Z

/cherry-pick release-2.38

* Fix images not loading on android" * Update app/components/expo_image/index.tsx Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update snapshots and remove accept * Fix 16KB page size patch failing due to stale diff context (#9555) The expo_image/index.tsx hunks in 9325-full.diff were generated before the NetworkManager/header-handling code was added to ExpoImage. The stale context lines caused patch's fuzzy matching to apply ExpoImage hunks to ExpoImageBackground instead, then ExpoImageBackground hunks failed because those sections were already modified. Regenerated the expo_image diff hunks to match the current file state with proper context lines for both ExpoImage (with header handling) and ExpoImageBackground components. https://claude.ai/code/session_01SGXWQzxrcPpWsq2YrjoUwd Co-authored-by: Claude <noreply@anthropic.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Your Name <larkox@gmail.com> Co-authored-by: Mattermost Build <build@mattermost.com> Co-authored-by: Claude <noreply@anthropic.com> (cherry picked from commit 46d4679)

mattermost-build · 2026-02-27T02:46:34Z

Cherry pick is scheduled.

* Fix images not loading on android" * Update app/components/expo_image/index.tsx Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update snapshots and remove accept * Fix 16KB page size patch failing due to stale diff context (#9555) The expo_image/index.tsx hunks in 9325-full.diff were generated before the NetworkManager/header-handling code was added to ExpoImage. The stale context lines caused patch's fuzzy matching to apply ExpoImage hunks to ExpoImageBackground instead, then ExpoImageBackground hunks failed because those sections were already modified. Regenerated the expo_image diff hunks to match the current file state with proper context lines for both ExpoImage (with header handling) and ExpoImageBackground components. https://claude.ai/code/session_01SGXWQzxrcPpWsq2YrjoUwd Co-authored-by: Claude <noreply@anthropic.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Your Name <larkox@gmail.com> Co-authored-by: Mattermost Build <build@mattermost.com> Co-authored-by: Claude <noreply@anthropic.com> (cherry picked from commit 46d4679)

* Fix images not loading on android" * Update app/components/expo_image/index.tsx * Update snapshots and remove accept * Fix 16KB page size patch failing due to stale diff context (#9555) The expo_image/index.tsx hunks in 9325-full.diff were generated before the NetworkManager/header-handling code was added to ExpoImage. The stale context lines caused patch's fuzzy matching to apply ExpoImage hunks to ExpoImageBackground instead, then ExpoImageBackground hunks failed because those sections were already modified. Regenerated the expo_image diff hunks to match the current file state with proper context lines for both ExpoImage (with header handling) and ExpoImageBackground components. https://claude.ai/code/session_01SGXWQzxrcPpWsq2YrjoUwd --------- (cherry picked from commit 46d4679) Co-authored-by: Nick Misasi <nick.misasi@mattermost.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Your Name <larkox@gmail.com> Co-authored-by: Claude <noreply@anthropic.com>

Fix images not loading on android"

fa14fae

mm-cloud-bot added the do-not-merge/release-note-label-needed label Feb 26, 2026

nickmisasi requested a review from larkox February 26, 2026 23:51

nickmisasi added the 2: Dev Review Requires review by a core commiter label Feb 26, 2026

nickmisasi requested a review from Copilot February 27, 2026 00:00

Copilot started reviewing on behalf of nickmisasi February 27, 2026 00:00 View session

Copilot AI reviewed Feb 27, 2026

View reviewed changes

app/components/expo_image/index.tsx Outdated Show resolved Hide resolved

Update app/components/expo_image/index.tsx

4d396af

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

nickmisasi added the Build App for Android Build the mobile app for Android label Feb 27, 2026

larkox approved these changes Feb 27, 2026

View reviewed changes

Update snapshots and remove accept

b92f54f

larkox added Build Apps for PR Build the mobile app for iOS and Android to test and removed Build App for Android Build the mobile app for Android labels Feb 27, 2026

mm-cloud-bot added release-note-none and removed do-not-merge/release-note-label-needed labels Feb 27, 2026

Merge branch 'main' into fix-images-not-loading-on-android

33dcfb2

nickmisasi added Build App for Android Build the mobile app for Android and removed Build Apps for PR Build the mobile app for iOS and Android to test labels Feb 27, 2026

nickmisasi added Build App for Android Build the mobile app for Android and removed 2: Dev Review Requires review by a core commiter Build App for Android Build the mobile app for Android labels Feb 27, 2026

nickmisasi merged commit 46d4679 into main Feb 27, 2026
26 checks passed

nickmisasi deleted the fix-images-not-loading-on-android branch February 27, 2026 02:36

mattermost-build mentioned this pull request Feb 27, 2026

Automated cherry pick of #9554 #9557

Merged

mattermost-build added the CherryPick/Done Successfully cherry-picked to the quality or patch release tracked in the milestone label Feb 27, 2026

mattermost-build mentioned this pull request Feb 27, 2026

Automated cherry pick of #9554 #9559

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix Android image loads by attaching auth headers#9554

Fix Android image loads by attaching auth headers#9554
nickmisasi merged 5 commits intomainfrom
fix-images-not-loading-on-android

nickmisasi commented Feb 26, 2026 •

edited by larkox

Loading

Uh oh!

mm-cloud-bot commented Feb 26, 2026

Uh oh!

nickmisasi commented Feb 26, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

nickmisasi commented Feb 27, 2026

Uh oh!

github-actions bot commented Feb 27, 2026 •

edited

Loading

Uh oh!

nickmisasi commented Feb 27, 2026

Uh oh!

Uh oh!

amyblais commented Feb 27, 2026

Uh oh!

mattermost-build commented Feb 27, 2026

Uh oh!

amyblais commented Feb 27, 2026

Uh oh!

mattermost-build commented Feb 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

nickmisasi commented Feb 26, 2026 • edited by larkox Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why this is necessary

Implementation details

Risk and scope

Test plan

Uh oh!

mm-cloud-bot commented Feb 26, 2026

Uh oh!

nickmisasi commented Feb 26, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

nickmisasi commented Feb 27, 2026

Uh oh!

github-actions bot commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage Comparison Report

Uh oh!

nickmisasi commented Feb 27, 2026

Uh oh!

Uh oh!

amyblais commented Feb 27, 2026

Uh oh!

mattermost-build commented Feb 27, 2026

Uh oh!

amyblais commented Feb 27, 2026

Uh oh!

mattermost-build commented Feb 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

nickmisasi commented Feb 26, 2026 •

edited by larkox

Loading

github-actions bot commented Feb 27, 2026 •

edited

Loading