Is it possible to bypass the Varnish cache when the user is logged in? I've tried using the "CraftSessionId" cookie, but it seems that it is also set for non logged in users.

2 Answers 2


CraftSessionId is just the PHP session cookie renamed, so you'll get it on every request that requires session, regardless if they are authenticated with Craft or not.

The Craft authentication cookie is a cookie with a 32 character randomly generated name. i.e. 7afe5904f6b2a09ce620eca02e80328c.

  • Thank you Brad! There is also another cookie ending with "username" i.e. 7afe5904f6b2a09ce620eca02e80328cusername, I guess it's safe to use it too? Oct 24, 2017 at 9:00
  • 1
    Yeah, that's just for populating the username on the login page. You can either allow it or set craftcms.com/docs/config-settings#rememberUsernameDuration to false to disable that feature.
    – Brad Bell
    Oct 25, 2017 at 23:56

So the answer is to test the cookie for a name with username in it, and pass if it exists. You could also check for an exactly 32 digit alphanumeric cookie name I guess.

if (
 req.http.Cookie ~ "username" # Craft sessions have the word username in them
    return (pass);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.