Client contacted us with problem with login system on one of pages we coded. Sometimes it happens that users log in as someone else. As much as we tried, we couldn't replicate it. I suspect Varnish is causing this (since first time client reported this issue was after sysadmin set it up), but I don't have much experiences with it and our sysadmin doesn't seem to be willing to help.
The page uses ESI. All user-specific includes aren't cached at all, with one exception: There's username in header in separate include. We cache this ESI with
Vary: Cookie, so that shouldn't be a problem.
Our setup on server is Nginx -> Varnish -> Apache. This is our Varnish config. Nginx shouldn't be caching anything (at least sysadmin claims so).
I suspect there is some typo or misconfiguration in Varnish config. Any hints are welcome.