DEV: enable cors to all cdn get requests from workbox. (#10685)

Now all external requests from the service worker will be in CORS mode without credentials.

app/controllers/application_controller.rb

@@ -42,6 +42,7 @@ class ApplicationController < ActionController::Base
   before_action :preload_json
   before_action :add_noindex_header, if: -> { is_feed_request? || !SiteSetting.allow_index_in_robots_txt }
   before_action :check_xhr
+  before_action :block_cdn_requests
   after_action  :add_readonly_header
   after_action  :perform_refresh_session
   after_action  :dont_cache_page
@@ -672,6 +673,19 @@ class ApplicationController < ActionController::Base
     raise ApplicationController::RenderEmpty.new unless ((request.format && request.format.json?) || request.xhr?)
   end
 
+  def block_cdn_requests
+    raise Discourse::NotFound if Discourse.is_cdn_request?(request.env, request.method)
+  end
+
+  def apply_cdn_headers
+    Discourse.apply_cdn_headers(response.headers) if Discourse.is_cdn_request?(request.env, request.method)
+  end
+
+  def self.cdn_action(args = {})
+    skip_before_action :block_cdn_requests, args
+    before_action :apply_cdn_headers, args
+  end
+
   def self.requires_login(arg = {})
     @requires_login_arg = arg
   end