Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Client contacted us with problem with login system on one of pages we coded. Sometimes it happens that users log in as someone else. As much as we tried, we couldn't replicate it. I suspect Varnish is causing this (since first time client reported this issue was after sysadmin set it up), but I don't have much experiences with it and our sysadmin doesn't seem to be willing to help.

The page uses ESI. All user-specific includes aren't cached at all, with one exception: There's username in header in separate include. We cache this ESI with Vary: Cookie, so that shouldn't be a problem.

Our setup on server is Nginx -> Varnish -> Apache. This is our Varnish config. Nginx shouldn't be caching anything (at least sysadmin claims so).

I suspect there is some typo or misconfiguration in Varnish config. Any hints are welcome.

share|improve this question

I suspect that this could be related to your vcl_hash function. If you don't need it, comment this out and see what happens -- try it first in a test server that mimics your client's setup.

Details follow: (I'm new to varnish, so here is my understanding):

This function is what varnish uses to "mark" cached content. Based on the logic here, the hash is either the request url, the host or server ip. If user1 comes along and logs in at, varnish marks that page with a hash using the host So when user2 comes along at the same host, varnish sees the page is already cached based on the rules in the hash function and delivers the cached page to user2 when it shouldn't. If the user2 logs in by visiting the IP address of the server, I'll bet you they would see their information. However, if user3 logs in via the IP address, he/she will see user2's information.

sub vcl_hash {
    hash_data(req.url); //This is never used 'cos of the lines that follow

    if ( {
    } else {

    return (hash);
share|improve this answer
That's about it. It's pretty odd to edit the vcl_hash in this way, the standard hash is normally sufficient! – Kirrus Jun 9 '12 at 15:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.