Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a server running varnish. In order that it works correctly with Magento it analyses whether a Set-Cookie: EXTERNAL_NO_CACHE=1 header is passed through.

Only problem is that we have several headers (3 or 4) that start with "Set-Cookie:". Varnish has a limitation that it can only analyze the first "Set-Cookie" header.

Therefore I would like to ask how I could merge these multiple set cookie headers? I have been looking around on this for the last 4 days without any luck =(

Maybe using mod_header of apaches but I'm not really sure what the correct approach would be?

Any other ideas?

Thanks in advance!

PS: Running Debian and Apache 2.2.9

EDIT: Here are example headers containing the multiple set-cookie lines:

root@magento-development:/# curl -I http://XXXXXXXXX
[1] 5332
root@magento-development:/# HTTP/1.1 200 OK
Date: Thu, 10 Nov 2011 14:49:56 GMT
Server: Apache/2.2.9 (Debian) PHP/5.2.6-1+lenny13 with Suhosin-Patch
X-Powered-By: PHP/5.2.6-1+lenny13
Set-Cookie: store=scfr; expires=Fri, 09-Nov-2012 14:49:56 GMT; path=/; domain=XXXXXXXXX; httponly
Set-Cookie: frontend=9ac04aa3912eb78eb79f98dd531f7ba6; expires=Thu, 10 Nov 2011 15:49:57 GMT; path=/; domain=XXXXXXXXX; HttpOnly
Expires: Thu, 10 Nov 2011 16:49:57 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: EXTERNAL_NO_CACHE=1; expires=Thu, 10-Nov-2011 15:49:57 GMT; path=/; domain=XXXXXXXXX; httponly
X-Cache-Debug: 1
Vary: Accept-Encoding,User-Agent
Content-Type: text/html; charset=UTF-8
share|improve this question

EDIT: modified apache config to match post requirements

First, merging cookie headers is a bad idea. See what Apache folks have to say about it .

Second, multiple set-cookie headers are supported by protocol specification. If varnish can't handle multiple set-cookie headers that should be considered a bug and reported.

Third, can't you make the dont-cache-this varnish rule dependent on another custom header? like X-Magento-NoCache that you can setup from app or from apache ? must it be a cookie? e.g.

rewriteengine on
rewritecond %{QUERY_STRING} ___store
rewriterule .* - [E=MAGENTO_DONT_CACHE:1]

header add X-Magento-NoCache 1 env=MAGENTO_DONT_CACHE
share|improve this answer
Ok merging cookies might be a bad idea indeed. Secondly: Ticket has been created: . Third: It's an encrypted commercial module that handles the application site, since it's encrypted that's a dead end too. – KennyDs Nov 10 '11 at 16:05
modified my post, added rewrites to conditionally set an env variable if a ___store is found in query string. then set the custom header only if env var was set. you may want to put that inside a <location /magento> tho so you won't accidentally match other apps using ___store in qs. or just add one more rewritecond to make sure you match magento urls with ___store in qs – sysfault Nov 10 '11 at 16:18
it doesn't matter for you if it's encrypted; you do the setups in apache and varnish – sysfault Nov 10 '11 at 16:19
Didn't have enough time left at work, will try it on monday and let you know. Thanks – KennyDs Nov 10 '11 at 18:57

Someone might come up with a better answer, but you might find find this provides hope for the future or a good last resort if you're willing to build a new version yourself:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.