add noindex

app/controllers/api/active_storage_blobs_proxy_controller.rb

@@ -8,6 +8,7 @@ module Api
     skip_authorization_check
 
     before_action :set_cors_headers
+    before_action :set_noindex_headers
 
     def show
       blob_uuid, purp, exp = ApplicationRecord.signed_id_verifier.verified(params[:signed_uuid])

app/controllers/api/active_storage_blobs_proxy_legacy_controller.rb

@@ -7,6 +7,9 @@ module Api
     skip_before_action :authenticate_user!
     skip_authorization_check
 
+    before_action :set_cors_headers
+    before_action :set_noindex_headers
+
     # rubocop:disable Metrics
     def show
       Rollbar.info('Blob legacy') if defined?(Rollbar)

app/controllers/api/api_base_controller.rb

@@ -66,6 +66,10 @@ module Api
       current_user&.account
     end
 
+    def set_noindex_headers
+      headers['X-Robots-Tag'] = 'noindex'
+    end
+
     def set_cors_headers
       headers['Access-Control-Allow-Origin'] = '*'
       headers['Access-Control-Allow-Methods'] = 'POST, GET, PUT, PATCH, DELETE, OPTIONS'