PERF: avoid cookies for all static, public, cached forever assets

app/controllers/application_controller.rb

@@ -281,6 +281,13 @@ class ApplicationController < ActionController::Base
     post_ids
   end
 
+  def no_cookies
+    # do your best to ensure response has no cookies
+    # longer term we may want to push this into middleware
+    headers.delete 'Set-Cookie'
+    request.session_options[:skip] = true
+  end
+
   private
 
     def preload_anonymous_data

app/controllers/highlight_js_controller.rb

@@ -2,6 +2,9 @@ class HighlightJsController < ApplicationController
   skip_before_filter :preload_json, :redirect_to_login_if_required, :check_xhr, :verify_authenticity_token, only: [:show]
 
   def show
+
+    no_cookies
+
     RailsMultisite::ConnectionManagement.with_hostname(params[:hostname]) do
 
       current_version = HighlightJs.version(SiteSetting.highlighted_languages)

app/controllers/site_customizations_controller.rb

@@ -2,6 +2,9 @@ class SiteCustomizationsController < ApplicationController
   skip_before_filter :preload_json, :check_xhr, :redirect_to_login_if_required
 
   def show
+
+    no_cookies
+
     cache_time = request.env["HTTP_IF_MODIFIED_SINCE"]
     cache_time = Time.rfc2822(cache_time) rescue nil if cache_time
     stylesheet_time =

app/controllers/stylesheets_controller.rb

@@ -3,6 +3,8 @@ class StylesheetsController < ApplicationController
 
   def show
 
+    no_cookies
+
     target,digest = params[:name].split("_")
 
     cache_time = request.env["HTTP_IF_MODIFIED_SINCE"]

app/controllers/user_avatars_controller.rb

@@ -24,6 +24,8 @@ class UserAvatarsController < ApplicationController
     params.require(:version)
     params.require(:size)
 
+    no_cookies
+
     return render_dot if params[:version] != LetterAvatar.version
 
     image = LetterAvatar.generate(params[:username].to_s, params[:size].to_i)
@@ -35,6 +37,9 @@ class UserAvatarsController < ApplicationController
   end
 
   def show
+
+    no_cookies
+
     # we need multisite support to keep a single origin pull for CDNs
     RailsMultisite::ConnectionManagement.with_hostname(params[:hostname]) do
       show_in_site(RailsMultisite::ConnectionManagement.current_hostname)