Revert "DEV: enable cors to all cdn get requests from workbox. (#10684)" (#11076)

Revert “DEV: enable cors to all cdn get requests from workbox. (#10684)” (#11076)

This reverts commit e3de45359f9bc7a71d9b8045a7e369fd0cf8f433.

We need to improve out strategy by adding a cache breaker with this change … some assets on CDNs and clients may have incorrect CORS headers which can cause stuff to break.

diff --git a/app/assets/javascripts/service-worker.js.erb b/app/assets/javascripts/service-worker.js.erb
index 0b736be..f264094 100644
--- a/app/assets/javascripts/service-worker.js.erb
+++ b/app/assets/javascripts/service-worker.js.erb
@@ -4,109 +4,24 @@ importScripts("<%= "#{Discourse.asset_host}#{Discourse.base_path}/javascripts/wo
 
 workbox.setConfig({
   modulePathPrefix: "<%= "#{Discourse.asset_host}#{Discourse.base_path}/javascripts/workbox" %>",
-  debug: <%= Rails.env.development? %>
+  debug: false
 });
 
 var authUrl = "<%= Discourse.base_path %>/auth/";
 
 var cacheVersion = "1";
-var discourseCacheName = "discourse-" + cacheVersion;
-var externalCacheName = "external-" + cacheVersion;
 
 // Cache all GET requests, so Discourse can be used while offline
-
 workbox.routing.registerRoute(
   function(args) {
-    return args.url.origin === location.origin && !args.url.pathname.startsWith(authUrl);
+    return !(args.url.origin === location.origin && args.url.pathname.startsWith(authUrl));
   }, // Match all except auth routes
   new workbox.strategies.NetworkFirst({ // This will only use the cache when a network request fails
-    cacheName: discourseCacheName,
+    cacheName: "discourse-" + cacheVersion,
     plugins: [
-      new workbox.cacheableResponse.Plugin({
-        statuses: [200] // opaque responses will return status code '0'
-      }), // for s3 secure media signed urls
-      new workbox.expiration.Plugin({
-        maxAgeSeconds: 7* 24 * 60 * 60, // 7 days
-        maxEntries: 250,
-        purgeOnQuotaError: true, // safe to automatically delete if exceeding the available storage
-      }),
-    ],
-  })
-);
-
-var cdnUrls = [];
-
-<% if GlobalSetting.try(:cdn_cors_enabled) %>
-cdnUrls = ["<%= "#{GlobalSetting.s3_cdn_url}" %>", "<%= "#{GlobalSetting.cdn_url}" %>"].filter(Boolean);
-
-if (cdnUrls.length > 0) {
-  var cdnCacheName = "cdn-" + cacheVersion;
-
-  var appendQueryStringPlugin = {
-    requestWillFetch: function (args) {
-      var request = args.request;
-
-      if (request.url.includes("avatar") || request.url.includes("emoji")) {
-        var url = new URL(request.url);
-        // Using this temporary query param to force browsers to redownload images from server.
-        url.searchParams.append('refresh', 'true');
-        return new Request(url.href, request);
-      }
-
-      return request;
-    }
-  };
-
-  workbox.routing.registerRoute(
-    function(args) {
-      var matching = cdnUrls.filter(
-        function(url) {
-          return args.url.href.startsWith(url);
-        }
-      );
-      return matching.length > 0;
-    }, // Match all cdn resources
-    new workbox.strategies.NetworkFirst({ // This will only use the cache when a network request fails
-      cacheName: cdnCacheName,
-      fetchOptions: {
-        mode: 'cors',
-        credentials: 'omit'
-      },
-      plugins: [
-        new workbox.expiration.Plugin({
-          maxAgeSeconds: 7* 24 * 60 * 60, // 7 days
-          maxEntries: 250,
-          purgeOnQuotaError: true, // safe to automatically delete if exceeding the available storage
-        }),
-        appendQueryStringPlugin
-      ],
-    })
-  );
-}
-<% end %>
-
-workbox.routing.registerRoute(
-  function(args) {
-    if (args.url.origin === location.origin) {
-      return false;
-    }
-
-    var matching = cdnUrls.filter(
-      function(url) {
-        return args.url.href.startsWith(url);
-      }
-    );
-    return matching.length === 0;
-  }, // Match all other external resources
-  new workbox.strategies.NetworkFirst({ // This will only use the cache when a network request fails
-    cacheName: externalCacheName,
-    plugins: [
-      new workbox.cacheableResponse.Plugin({
-        statuses: [200] // opaque responses will return status code '0'
-      }),
       new workbox.expiration.Plugin({
         maxAgeSeconds: 7* 24 * 60 * 60, // 7 days
-        maxEntries: 250,
+        maxEntries: 500,
         purgeOnQuotaError: true, // safe to automatically delete if exceeding the available storage
       }),
     ],
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 438fc52..693970d 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -42,7 +42,6 @@ class ApplicationController < ActionController::Base
   before_action :preload_json
   before_action :add_noindex_header, if: -> { is_feed_request? || !SiteSetting.allow_index_in_robots_txt }
   before_action :check_xhr
-  before_action :block_cdn_requests
   after_action  :add_readonly_header
   after_action  :perform_refresh_session
   after_action  :dont_cache_page
@@ -673,19 +672,6 @@ class ApplicationController < ActionController::Base
     raise ApplicationController::RenderEmpty.new unless ((request.format && request.format.json?) || request.xhr?)
   end
 
-  def block_cdn_requests
-    raise Discourse::NotFound if Discourse.is_cdn_request?(request.env, request.method)
-  end
-
-  def apply_cdn_headers
-    Discourse.apply_cdn_headers(response.headers) if Discourse.is_cdn_request?(request.env, request.method)
-  end
-
-  def self.cdn_action(args = {})
-    skip_before_action :block_cdn_requests, args
-    before_action :apply_cdn_headers, args
-  end
-
   def self.requires_login(arg = {})
     @requires_login_arg = arg
   end
diff --git a/app/controllers/highlight_js_controller.rb b/app/controllers/highlight_js_controller.rb
index 55dab46..768c4e7 100644
--- a/app/controllers/highlight_js_controller.rb
+++ b/app/controllers/highlight_js_controller.rb
@@ -3,8 +3,6 @@
 class HighlightJsController < ApplicationController
   skip_before_action :preload_json, :redirect_to_login_if_required, :check_xhr, :verify_authenticity_token, only: [:show]
 
-  cdn_action only: [:show]
-
   def show
 
     no_cookies
diff --git a/app/controllers/static_controller.rb b/app/controllers/static_controller.rb
index 519c265..16f6925 100644
--- a/app/controllers/static_controller.rb
+++ b/app/controllers/static_controller.rb
@@ -7,8 +7,6 @@ class StaticController < ApplicationController
   skip_before_action :preload_json, only: [:brotli_asset, :cdn_asset, :enter, :favicon, :service_worker_asset]
   skip_before_action :handle_theme, only: [:brotli_asset, :cdn_asset, :enter, :favicon, :service_worker_asset]
 
-  cdn_action only: [:brotli_asset, :cdn_asset, :enter, :favicon, :service_worker_asset]
-
   PAGES_WITH_EMAIL_PARAM = ['login', 'password_reset', 'signup']
   MODAL_PAGES = ['password_reset', 'signup']
 
diff --git a/app/controllers/stylesheets_controller.rb b/app/controllers/stylesheets_controller.rb
index a96cbec..163ed9e 100644
--- a/app/controllers/stylesheets_controller.rb
+++ b/app/controllers/stylesheets_controller.rb
@@ -3,8 +3,6 @@
 class StylesheetsController < ApplicationController
   skip_before_action :preload_json, :redirect_to_login_if_required, :check_xhr, :verify_authenticity_token, only: [:show, :show_source_map, :color_scheme]
 
-  cdn_action only: [:show, :show_source_map, :color_scheme]
-
   def show_source_map
     show_resource(source_map: true)
   end
diff --git a/app/controllers/svg_sprite_controller.rb b/app/controllers/svg_sprite_controller.rb
index 7b15d83..81b9705 100644
--- a/app/controllers/svg_sprite_controller.rb
+++ b/app/controllers/svg_sprite_controller.rb
@@ -3,8 +3,6 @@
 class SvgSpriteController < ApplicationController
   skip_before_action :preload_json, :redirect_to_login_if_required, :check_xhr, :verify_authenticity_token, only: [:show, :search, :svg_icon]
 
-  cdn_action only: [:show, :search, :svg_icon]
-
   requires_login except: [:show, :svg_icon]
 
   def show
diff --git a/app/controllers/theme_javascripts_controller.rb b/app/controllers/theme_javascripts_controller.rb
index 3323a33..0fb5f52 100644
--- a/app/controllers/theme_javascripts_controller.rb
+++ b/app/controllers/theme_javascripts_controller.rb

[... diff too long, it was truncated ...]

GitHub sha: af4938ba

This commit appears in #11076 which was approved by SamSaffron. It was merged by SamSaffron.

This commit has been mentioned on Discourse Meta. There might be relevant details there:

https://meta.discourse.org/t/multiple-error-messages-in-console/168670/8