Disable session in ActiveStorage blobs and representations proxy controllers

[brunoprietog]

Motivation / Background

When configuring ActiveStorage with resolve_model_to_route in rails_storage_proxy, you would expect a CDN such as CloudFlare to cache the files. However, in the case of CloudFlare, by default, anything that has session cookies will not cache them. To work around this you can use custom rules or patch these ActiveStorage proxy controllers.

Detail

Session now is disabled in ActiveStorage::Blobs::ProxyController and ActiveStorage::Representations::ProxyController, including the new concern ActiveStorage::DisableSession in both controllers that does the work.

This way it will not be necessary to create custom rules and works by default.

Thanks to @fleck for the idea in this comment.

Fixes #44136

Additional information

I'm not sure if or how to test this, because there is no way to access the session in ActionDispatch::IntegrationTest.

Checklist

Before submitting the PR make sure the following are checked:

• This Pull Request is related to one change. Changes that are unrelated should be opened in separate PRs.
• Commit message has a detailed description of what changed and why. If this PR fixes a related issue include it in the commit message. Ex: [Fix #issue-number]
• Tests are added or updated if you fix a bug or add a feature.
• CHANGELOG files are updated for the changed libraries if there is a behavior change or additional feature. Minor bug fixes and documentation changes should not be included.

[brenogazzola]

Beyond CDN compatibility, this will also prevent a footgun for developers who are starting to handle on their own infra and want to use something like nginx object cache, where they cache the file but forget to remove the Set-Cookie header from the response doing so.

This is a problem because rails uses said header to store its session, which might contain sensitive data. Worst case scenario, it might contain the ID of the logged user, which means that when the file is served, the user will be automatically switched to a different account.