Disable session in ActiveStorage blobs and representations proxy controllers

activestorage/CHANGELOG.md

@@ -1,3 +1,11 @@
+*   Disables the session in `ActiveStorage::Blobs::ProxyController`
+    and `ActiveStorage::Representations::ProxyController`
+    in order to allow caching by default in some CDNs as CloudFlare
+
+    Fixes #44136
+
+    *Bruno Prieto*
+
 *   Add `tags` to `ActiveStorage::Analyzer::AudioAnalyzer` output
 
     *Keaton Roux*

activestorage/app/controllers/active_storage/blobs/proxy_controller.rb

@@ -9,6 +9,7 @@
 class ActiveStorage::Blobs::ProxyController < ActiveStorage::BaseController
   include ActiveStorage::SetBlob
   include ActiveStorage::Streaming
+  include ActiveStorage::DisableSession
 
   def show
     if request.headers["Range"].present?

activestorage/app/controllers/active_storage/representations/proxy_controller.rb

@@ -8,6 +8,7 @@
 # {Authenticated Controllers}[https://guides.rubyonrails.org/active_storage_overview.html#authenticated-controllers].
 class ActiveStorage::Representations::ProxyController < ActiveStorage::Representations::BaseController
   include ActiveStorage::Streaming
+  include ActiveStorage::DisableSession
 
   def show
     http_cache_forever public: true do

activestorage/app/controllers/concerns/active_storage/disable_session.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+# This concern disables the session in order to allow caching by default in some CDNs as CloudFlare.
+module ActiveStorage::DisableSession
+  extend ActiveSupport::Concern
+
+  included do
+    before_action do
+      request.session_options[:skip] = true
+    end
+  end
+end