Is it possible to bypass the Varnish cache when the user is logged in? I've tried using the "CraftSessionId" cookie, but it seems that it is also set for non logged in users.
2 Answers
CraftSessionId is just the PHP session cookie renamed, so you'll get it on every request that requires session, regardless if they are authenticated with Craft or not.
The Craft authentication cookie is a cookie with a 32 character randomly generated name. i.e. 7afe5904f6b2a09ce620eca02e80328c.
answered Oct 18, 2017 at 17:36
-
Thank you Brad! There is also another cookie ending with "username" i.e.
7afe5904f6b2a09ce620eca02e80328cusername, I guess it's safe to use it too? Oct 24, 2017 at 9:00 -
1Yeah, that's just for populating the username on the login page. You can either allow it or set craftcms.com/docs/config-settings#rememberUsernameDuration to
falseto disable that feature.– Brad Bell ♦Oct 25, 2017 at 23:56
So the answer is to test the cookie for a name with username in it, and pass if it exists. You could also check for an exactly 32 digit alphanumeric cookie name I guess.
if (
req.http.Cookie ~ "username" # Craft sessions have the word username in them
)
{
return (pass);
}`
