fix(ui): don't create web sessions for media proxy requests

The media proxy is a public route, so the web session middleware
inserted a web_sessions row for every proxied request that arrived
without a session cookie. The handler never reads the session. API,
Fever and Google Reader clients get media proxy URLs in entry content
and fetch them without cookies, so each image they load added a row.

Add /proxy/ to the routes the web session middleware skips, alongside
static assets.

internal/ui/routes.go

@@ -22,7 +22,8 @@ func isStaticAssetRoute(r *http.Request) bool {
 	return strings.HasPrefix(path, "/stylesheets/") ||
 		strings.HasPrefix(path, "/js/") ||
 		strings.HasPrefix(path, "/icon/") ||
-		strings.HasPrefix(path, "/feed-icon/")
+		strings.HasPrefix(path, "/feed-icon/") ||
+		strings.HasPrefix(path, "/proxy/")
 }
 
 // isPublicRoute checks if the request path corresponds to a route that
@@ -43,8 +44,7 @@ func isPublicRoute(r *http.Request) bool {
 	}
 
 	return strings.HasPrefix(path, "/oauth2/") && (strings.HasSuffix(path, "/redirect") || strings.HasSuffix(path, "/callback")) ||
-		strings.HasPrefix(path, "/share/") ||
-		strings.HasPrefix(path, "/proxy/")
+		strings.HasPrefix(path, "/share/")
 }
 
 // loginRedirectURL builds the login page URL with the given request URI

internal/ui/routes_test.go

@@ -0,0 +1,37 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package ui // import "miniflux.app/v2/internal/ui"
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestIsStaticAssetRoute(t *testing.T) {
+	scenarios := []struct {
+		path     string
+		expected bool
+	}{
+		{"/favicon.ico", true},
+		{"/robots.txt", true},
+		{"/stylesheets/checksum/light_serif.css", true},
+		{"/js/checksum/app.js", true},
+		{"/icon/checksum/icon-120.png", true},
+		{"/feed-icon/external-id", true},
+		{"/proxy/digest/url", true},
+		{"/", false},
+		{"/login", false},
+		{"/manifest.json", false},
+		{"/share/code", false},
+		{"/unread", false},
+	}
+
+	for _, scenario := range scenarios {
+		r := httptest.NewRequest(http.MethodGet, scenario.path, nil)
+		if result := isStaticAssetRoute(r); result != scenario.expected {
+			t.Errorf(`Unexpected result for %q, got %v instead of %v`, scenario.path, result, scenario.expected)
+		}
+	}
+}