1

Is it possible to bypass the Varnish cache when the user is logged in? I've tried using the "CraftSessionId" cookie, but it seems that it is also set for non logged in users.

0

CraftSessionId is just the PHP session cookie renamed, so you'll get it on every request that requires session, regardless if they are authenticated with Craft or not.

The Craft authentication cookie is a cookie with a 32 character randomly generated name. i.e. 7afe5904f6b2a09ce620eca02e80328c.

  • Thank you Brad! There is also another cookie ending with "username" i.e. 7afe5904f6b2a09ce620eca02e80328cusername, I guess it's safe to use it too? – José Manosalvas Oct 24 '17 at 9:00
  • 1
    Yeah, that's just for populating the username on the login page. You can either allow it or set craftcms.com/docs/config-settings#rememberUsernameDuration to false to disable that feature. – Brad Bell Oct 25 '17 at 23:56
1

So the answer is to test the cookie for a name with username in it, and pass if it exists. You could also check for an exactly 32 digit alphanumeric cookie name I guess.

if (
 req.http.Cookie ~ "username" # Craft sessions have the word username in them
)
{
    return (pass);
}`

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.