1

I have nginx php-fpm server for my website. I would like to use microcache for nginx. At first everything works fine. I get "hit" with curl command. Problem starts when i try to login. I tried everything but couldnt solve login problem.

I set "logged_in" cookie for 10 sec and at "cache config" i set "no-cache" for that cookie. It suppose to bypass caching while there is that cookie. I have "put" no-cache setting which is my login. Also my website has exmple.org/?i=login so i dont now whats going on when i click login :D.

Main mage is cachable but login returns un-loged in main page and after refresh i became loged in user. and for logout, it logs me out but after refresh still i am loged in user. So i have no idea how to fix/bypass login process.

Please help me out.

Server Config:

    fastcgi_cache_path /usr/share/nginx/cache/fcgi levels=1:2    keys_zone=microcache:32m max_size=1024m inactive=3h;
    fastcgi_cache_key $scheme$host$request_uri$request_method;
    fastcgi_cache_use_stale updating error timeout invalid_header http_500;
    fastcgi_ignore_headers Cache-Control Expires Set-Cookie;
    add_header X-Cache $upstream_cache_status;

    server {
        listen ip:80;
        server_name example.org;
        return 301 $scheme://www.example.org$request_uri;
    }

    server {
        server_name www.example.org;
        listen ip:80;
        root /home/example/public_html;
        index index.html index.htm index.php;
        access_log /var/log/virtualmin/example.org_access_log;
        error_log /var/log/virtualmin/example.org_error_log;
        fastcgi_buffers 16 16k; 
        fastcgi_buffer_size 32k;
        include /etc/nginx/example.d/cache.conf;

        location / {
            try_files $uri $uri/ /index.php?$args;
        }

        location ~ \.php$ {
            try_files $uri =404;
            fastcgi_split_path_info ^(.+\.php)(/.+)$;
            fastcgi_cache  microcache;
            fastcgi_cache_key $scheme$host$request_uri$request_method;
            fastcgi_cache_valid 200 301 302 30s;
            #fastcgi_pass_header Set-Cookie;
            #fastcgi_pass_header Cookie;
            fastcgi_cache_bypass $no_cache;
            fastcgi_no_cache $no_cache;
            fastcgi_pass unix:/run/php/php5.6-fpm_example.sock;
            fastcgi_index index.php;
            include /etc/nginx/example.d/fastcgi.conf;
        }

        location ~* \.(jpg|jpeg|gif|css|png|js|woff|ttf|svg|ico|eot)$ {
            access_log        off;
            log_not_found     off;
            expires           max;
        }

        location = /favicon.ico {
            log_not_found off;
            access_log off;
        }

        location = /robots.txt {
            allow all;
            log_not_found off;
            access_log off;
        }

        location ~ /\. {
            access_log off;
            log_not_found off; 
            deny all;
        }

        include /etc/nginx/example.d/redirect.conf;
        include /etc/nginx/example.d/rewrite.conf;
    }

Cache Config (as include at server config):

#Cache everything by default
set $no_cache 0;

#Don't cache POST requests
if ($request_method = POST)
{
    set $no_cache 1;
}

#Don't cache if the URL contains a query string
if ($query_string != "")
{
    set $no_cache 1;
}

#Don't cache the following URLs
if ($request_uri ~* "/*login*|/*ajax*|/sistem/modul/login.php")
{
    set $no_cache 1;
}

#Don't cache if there is a cookie called PHPSESSID
if ($http_cookie = "Logged_in")
{
    set $no_cache 1;
}

EDIT: Actually after some inspections i am pretty sure that my problem is just with phpsessid. Every connection has phpsessid and nginx cache them too or completely ignore them by directives. If i cache phpsesid and if login first with browser with admin account everyone has get admin logged in cache :D I need a connections phpsessid should protected.

Its like nginx should clear phpsessid cookie at first and send php to fastcgi. and return of that php from fastcgi server nginx should attach same phpsessid which cleared at first. Or its like cache php or everything without phpsessid cookie and when servering content from cache nginx should attach untouched, official phpsessid to them.

So with that way every visiter will have unique phpsessid and have cached content, which will resolve my login problems.

I can probably clear and set phpsessid. But i dont now how to save that unique/specific phpsessid and re-set it again. Or may be its not even possible. I came up with theory and have no idea how to do :D

1

Maybe you should take the easy route and just define a block for your login URL and turn off caching manually. This is how I do it for Wordpress.

I have this rate limiting block outside the server definition (I have a log traffic website so 1 login per second is more than enough).

limit_req_zone $binary_remote_addr zone=login:1m rate=1r/s;

This is inside my server

# Rate limit wp-login.php to prevent brute force attacks
location = /wp-login.php {
  # Next line applies the rate limit defined above
  limit_req zone=login burst=3;       
  fastcgi_keep_conn on;
  fastcgi_intercept_errors on;
  fastcgi_pass   php;
  include        fastcgi_params;
  fastcgi_param  SCRIPT_FILENAME $document_root$fastcgi_script_name;

  # No caching
  more_clear_headers "Cache-Control";
  add_header Cache-Control "private, max-age=0, no-cache, no-store";
  more_clear_headers "Expires";    
}

I have more on my Wordpress/Nginx tutorial, here.

Update

This is what I have in my Nginx configuration for Wordpress

if ($http_cookie ~* "comment_author|wordpress_[a-f0-9]+|wordpress_logged_in") {
set $skip_cache 1;

}

Have a read of the tutorial I linked to above, I have a fairly effective Nginx config for Wordpress you can likely take as-is or copy and paste parts from.

  • Thanks for your reply. But as you may see from my "Edit" at first post, problem is not the url i am using to login. My system caches phpsessid too and servers it to all visitors. – Yanik Dec 21 '16 at 9:40
  • @Yanik see my edit. Suggest referring to the tutorial I wrote and linked to, it covers this and a lot more, and has downloadable config files. – Tim Dec 21 '16 at 18:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.