Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to use Varnish to cache certain pages even in the presence of cookies. There are 3 possibilities that I need to take care of:

  1. An anonymous user is viewing some page
  2. A logged in user is viewing some page with light customization. These customizations are all stored in a signed-cookie and are dynamically populated by Javascript. The vary-cookie http header is not set.
  3. A logged in user is viewing some page with customized data from the database. The vary-cookie http header is set.

The expected behaviors would be:

  1. Cache the page. This is the most basic scenario for Varnish to handle.
  2. Cache the page and do not delete the cookie because some Javascript logic needs it.
  3. Never cache this page because vary-cookie is signalling the cookie contents will affect the output of this page.

I have read some docs on Varnish and I cannot tell if this is the default behavior or if there is some setup I have to do in VCL to make it happen.

share|improve this question

By default Varnish doesn't cache requests with a Cookie header:

  sub vcl_recv {
  if (req.http.Authorization || req.http.Cookie) {
        /* Not cacheable by default */
        return (pass);
    return (lookup);

You need to code the behaviour you want into the configuration. Be aware that the Cookie is part of the client request, not the "page" (object, really). The "page" (object) comes with a "Set-Cookie" header - that's the one that will be cached.

Also, "Vary: Cookie" doesn't mean "do not cache". It means cache one object for every value of Cookie received.

If your application doesn't generate any content based on Cookie, it's probably safe to ignore it:

-      if (req.http.Authorization || req.http.Cookie) {
+      if (req.http.Authorization) {

Do some tests and you will get the hang of it. Hope this helps.

share|improve this answer
Ok this is starting to make more sense now. I definitely don't want to cache responses with the set-cookie header because things like the CSRF token get set there. – Jason Christa Nov 25 '10 at 13:53
Also can I use the Vary: Cookie header a signal not to try to cache the page. If you had 10,000 active users, caching a page for each of them is probably a waste of space. – Jason Christa Nov 25 '10 at 13:55
If you don't want the page to be cached for each user have the application return "Cache-Control: private" – XCondE Dec 4 '10 at 7:03

If I understand you correctly, you do not want a specific cookie as part of the key - but you need to leave it intact?

You need to set the hash in vcl_hash to be req.url + (and possibly others), but not the specific cookie..

I think one of my posts could help you in the right direction: Ignoring GET parameters in Varnish VCL

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.