{"action":"created","issue":{"url":"https://api.github.com/repos/nexcess/magento-turpentine/issues/779","labels_url":"https://api.github.com/repos/nexcess/magento-turpentine/issues/779/labels{/name}","comments_url":"https://api.github.com/repos/nexcess/magento-turpentine/issues/779/comments","events_url":"https://api.github.com/repos/nexcess/magento-turpentine/issues/779/events","html_url":"https://github.com/nexcess/magento-turpentine/issues/779","id":71485747,"number":779,"title":"Seems that Varnish caches cart cookie","user":{"login":"stammmedia","id":5036944,"avatar_url":"https://avatars.githubusercontent.com/u/5036944?v=3","gravatar_id":"","url":"https://api.github.com/users/stammmedia","html_url":"https://github.com/stammmedia","followers_url":"https://api.github.com/users/stammmedia/followers","following_url":"https://api.github.com/users/stammmedia/following{/other_user}","gists_url":"https://api.github.com/users/stammmedia/gists{/gist_id}","starred_url":"https://api.github.com/users/stammmedia/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stammmedia/subscriptions","organizations_url":"https://api.github.com/users/stammmedia/orgs","repos_url":"https://api.github.com/users/stammmedia/repos","events_url":"https://api.github.com/users/stammmedia/events{/privacy}","received_events_url":"https://api.github.com/users/stammmedia/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-04-28T05:38:36Z","updated_at":"2015-05-08T09:27:39Z","closed_at":null,"body":"Hello,\r\n\r\nwe are using Magento EE 1.14.1.0 with latest turpentine.\r\n\r\nEverything works fine except that the cart is being cached, but not the cart view, the items in cart itself, which seem to be caused by caching the cart cookie and delivering the cookie to all visitors.\r\n\r\nThis is our VCL:\r\n\r\nC{\r\n#include <stdlib.h>\r\n#include <stdio.h>\r\n#include <time.h>\r\n#include <pthread.h>\r\nstatic pthread_mutex_t lrand_mutex = PTHREAD_MUTEX_INITIALIZER;\r\nvoid generate_uuid(char* buf) {\r\npthread_mutex_lock(&lrand_mutex);\r\nlong a = lrand48();\r\nlong b = lrand48();\r\nlong c = lrand48();\r\nlong d = lrand48();\r\npthread_mutex_unlock(&lrand_mutex);\r\nsprintf(buf, \"frontend=%08lx%04lx%04lx%04lx%04lx%08lx\",\r\na,\r\nb & 0xffff,\r\n(b & ((long)0x0fff0000) >> 16) | 0x4000,\r\n(c & 0x0fff) | 0x8000,\r\n(c & (long)0xffff0000) >> 16,\r\nd\r\n);\r\nreturn;\r\n}\r\n}C\r\nimport std;\r\nbackend default {\r\n.host = \"127.0.0.1\";\r\n.port = \"8080\";\r\n.first_byte_timeout = 300s;\r\n.between_bytes_timeout = 300s;\r\n}\r\nbackend admin {\r\n.host = \"127.0.0.1\";\r\n.port = \"8080\";\r\n.first_byte_timeout = 21600s;\r\n.between_bytes_timeout = 21600s;\r\n}\r\nacl crawler_acl {\r\n\"127.0.0.1\";\r\n}\r\nacl debug_acl {\r\n}\r\nsub generate_session {\r\nif (req.url ~ \".*[&?]SID=([^&]+).*\") {\r\nset req.http.X-Varnish-Faked-Session = regsub(\r\nreq.url, \".*[&?]SID=([^&]+).*\", \"frontend=\\1\");\r\n} else {\r\nC{\r\nchar uuid_buf [50];\r\ngenerate_uuid(uuid_buf);\r\nVRT_SetHdr(sp, HDR_REQ,\r\n\"\\030X-Varnish-Faked-Session:\",\r\nuuid_buf,\r\nvrt_magic_string_end\r\n);\r\n}C\r\n}\r\nif (req.http.Cookie) {\r\nstd.collect(req.http.Cookie);\r\nset req.http.Cookie = req.http.X-Varnish-Faked-Session +\r\n\"; \" + req.http.Cookie;\r\n} else {\r\nset req.http.Cookie = req.http.X-Varnish-Faked-Session;\r\n}\r\n}\r\nsub generate_session_expires {\r\nC{\r\ntime_t now = time(NULL);\r\nstruct tm now_tm = *gmtime(&now);\r\nnow_tm.tm_sec += 3600;\r\nmktime(&now_tm);\r\nchar date_buf [50];\r\nstrftime(date_buf, sizeof(date_buf)-1, \"%a, %d-%b-%Y %H:%M:%S %Z\", &now_tm);\r\nVRT_SetHdr(sp, HDR_RESP,\r\n\"\\031X-Varnish-Cookie-Expires:\",\r\ndate_buf,\r\nvrt_magic_string_end\r\n);\r\n}C\r\n}\r\nsub vcl_recv {\r\nif (req.restarts == 0) {\r\nif (req.http.X-Forwarded-For) {\r\nset req.http.X-Forwarded-For =\r\nreq.http.X-Forwarded-For + \", \" + client.ip;\r\n} else {\r\nset req.http.X-Forwarded-For = client.ip;\r\n}\r\n}\r\nif (!true || req.http.Authorization ||\r\nreq.request !~ \"^(GET|HEAD)$\" ||\r\nreq.http.Cookie ~ \"varnish_bypass=1\") {\r\nreturn (pipe);\r\n}\r\nset req.url = regsuball(req.url, \"(.*)//+(.*)\", \"\\1/\\2\");\r\nif (req.url ~ \"^(/media/|/skin/|/js/|/)(?:(?:index|litespeed)\\.php/)?\") {\r\nset req.http.X-Turpentine-Secret-Handshake = \"1\";\r\nif (req.url ~ \"^(/media/|/skin/|/js/|/)(?:(?:index|litespeed)\\.php/)?xtwoadmin\") {\r\nset req.backend = admin;\r\nreturn (pipe);\r\n}\r\nif (req.http.Cookie ~ \"\\bcurrency=\") {\r\nset req.http.X-Varnish-Currency = regsub(\r\nreq.http.Cookie, \".*\\bcurrency=([^;]*).*\", \"\\1\");\r\n}\r\nif (req.http.Cookie ~ \"\\bstore=\") {\r\nset req.http.X-Varnish-Store = regsub(\r\nreq.http.Cookie, \".*\\bstore=([^;]*).*\", \"\\1\");\r\n}\r\nif (req.url ~ \"/turpentine/esi/get(?:Block|FormKey)/\") {\r\nset req.http.X-Varnish-Esi-Method = regsub(\r\nreq.url, \".*/method/(\\w+)/.*\", \"\\1\");\r\nset req.http.X-Varnish-Esi-Access = regsub(\r\nreq.url, \".*/access/(\\w+)/.*\", \"\\1\");\r\nif (req.http.X-Varnish-Esi-Method == \"esi\" && req.esi_level == 0 &&\r\n!(true || client.ip ~ debug_acl)) {\r\nerror 403 \"External ESI requests are not allowed\";\r\n}\r\n}\r\nif (req.http.Cookie !~ \"frontend=\") {\r\nif (client.ip ~ crawler_acl ||\r\nreq.http.User-Agent ~ \"^(?:ApacheBench/.*|.*Googlebot.*|JoeDog/.*Siege.*|magespeedtest\\.com|Nexcessnet_Turpentine/.*)$\") {\r\nset req.http.Cookie = \"frontend=crawler-session\";\r\n} else {\r\ncall generate_session;\r\n}\r\n}\r\nif (false &&\r\nreq.url ~ \".*\\.(?:css|js|jpeg|jpg|png|gif|ico|swf)(?=\\?|&|$)\") {\r\nunset req.http.Cookie;\r\nunset req.http.X-Varnish-Faked-Session;\r\nreturn (lookup);\r\n}\r\nif (req.url ~ \"^(/media/|/skin/|/js/|/)(?:(?:index|litespeed)\\.php/)?(?:xtwoadmin|api|cron\\.php|/xtwoadmin/|/index.php/xtwoadmin/|/index.php/mageworx/|/checkout/|/wishlist/|/customer/|/var/|/sitemap/|/catalog/product_compare/|checkout/|customer/|sitemap/|var/|wishlist/|catalog/product_compare/)\" ||\r\nreq.url ~ \"\\?.*__from_store=\") {\r\nreturn (pipe);\r\n}\r\nif (true &&\r\nreq.url ~ \"(?:[?&](?:__SID|XDEBUG_PROFILE)(?=[&=]|$))\") {\r\nreturn (pass);\r\n}\r\nif (req.url ~ \"[?&](utm_source|utm_medium|utm_campaign|gclid|cx|ie|cof|siteurl)=\") {\r\nset req.url = regsuball(req.url, \"(?:(\\?)?|&)(?:utm_source|utm_medium|utm_campaign|gclid|cx|ie|cof|siteurl)=[^&]+\", \"\\1\");\r\nset req.url = regsuball(req.url, \"(?:(\\?)&|\\?$)\", \"\\1\");\r\n}\r\nreturn (lookup);\r\n}\r\n}\r\nsub vcl_pipe {\r\nunset bereq.http.X-Turpentine-Secret-Handshake;\r\nset bereq.http.Connection = \"close\";\r\n}\r\nsub vcl_hash {\r\nhash_data(req.url);\r\nif (req.http.Host) {\r\nhash_data(req.http.Host);\r\n} else {\r\nhash_data(server.ip);\r\n}\r\nhash_data(req.http.Ssl-Offloaded);\r\nif (req.http.X-Normalized-User-Agent) {\r\nhash_data(req.http.X-Normalized-User-Agent);\r\n}\r\nif (req.http.Accept-Encoding) {\r\nhash_data(req.http.Accept-Encoding);\r\n}\r\nif (req.http.X-Varnish-Store || req.http.X-Varnish-Currency) {\r\nhash_data(\"s=\" + req.http.X-Varnish-Store + \"&c=\" + req.http.X-Varnish-Currency);\r\n}\r\nif (req.http.X-Varnish-Esi-Access == \"private\" &&\r\nreq.http.Cookie ~ \"frontend=\") {\r\nhash_data(regsub(req.http.Cookie, \"^.*?frontend=([^;]*);*.*$\", \"\\1\"));\r\n}\r\nreturn (hash);\r\n}\r\nsub vcl_hit {\r\n}\r\nsub vcl_fetch {\r\nset req.grace = 15s;\r\nset beresp.http.X-Varnish-Host = req.http.host;\r\nset beresp.http.X-Varnish-URL = req.url;\r\nif (req.url ~ \"^(/media/|/skin/|/js/|/)(?:(?:index|litespeed)\\.php/)?\") {\r\nunset beresp.http.Vary;\r\nset beresp.do_gzip = true;\r\nif (beresp.status != 200 && beresp.status != 404) {\r\nset beresp.ttl = 15s;\r\nreturn (hit_for_pass);\r\n} else {\r\nif (beresp.http.Set-Cookie) {\r\nset beresp.http.X-Varnish-Set-Cookie = beresp.http.Set-Cookie;\r\nunset beresp.http.Set-Cookie;\r\n}\r\nunset beresp.http.Cache-Control;\r\nunset beresp.http.Expires;\r\nunset beresp.http.Pragma;\r\nunset beresp.http.Cache;\r\nunset beresp.http.Age;\r\nif (beresp.http.X-Turpentine-Esi == \"1\") {\r\nset beresp.do_esi = true;\r\n}\r\nif (beresp.http.X-Turpentine-Cache == \"0\") {\r\nset beresp.ttl = 15s;\r\nreturn (hit_for_pass);\r\n} else {\r\nif (false &&\r\nbereq.url ~ \".*\\.(?:css|js|jpeg|jpg|png|gif|ico|swf)(?=\\?|&|$)\") {\r\nset beresp.ttl = 604800s;\r\nset beresp.http.Cache-Control = \"max-age=604800\";\r\n} elseif (req.http.X-Varnish-Esi-Method) {\r\nif (req.http.X-Varnish-Esi-Access == \"private\" &&\r\nreq.http.Cookie ~ \"frontend=\") {\r\nset beresp.http.X-Varnish-Session = regsub(req.http.Cookie,\r\n\"^.*?frontend=([^;]*);*.*$\", \"\\1\");\r\n}\r\nif (req.http.X-Varnish-Esi-Method == \"ajax\" &&\r\nreq.http.X-Varnish-Esi-Access == \"public\") {\r\nset beresp.http.Cache-Control = \"max-age=\" + regsub(\r\nreq.url, \".*/ttl/(\\d+)/.*\", \"\\1\");\r\n}\r\nset beresp.ttl = std.duration(\r\nregsub(\r\nreq.url, \".*/ttl/(\\d+)/.*\", \"\\1s\"),\r\n300s);\r\nif (beresp.ttl == 0s) {\r\nset beresp.ttl = 15s;\r\nreturn (hit_for_pass);\r\n}\r\n} else {\r\nset beresp.ttl = 604800s;\r\n}\r\n}\r\n}\r\nreturn (deliver);\r\n}\r\n}\r\nsub vcl_deliver {\r\nif (req.http.X-Varnish-Faked-Session) {\r\ncall generate_session_expires;\r\nset resp.http.Set-Cookie = req.http.X-Varnish-Faked-Session +\r\n\"; expires=\" + resp.http.X-Varnish-Cookie-Expires + \"; path=/\";\r\nif (req.http.Host) {\r\nset resp.http.Set-Cookie = resp.http.Set-Cookie +\r\n\"; domain=\" + regsub(req.http.Host, \":\\d+$\", \"\");\r\n}\r\nset resp.http.Set-Cookie = resp.http.Set-Cookie + \"; httponly\";\r\nunset resp.http.X-Varnish-Cookie-Expires;\r\n}\r\nif (req.http.X-Varnish-Esi-Method == \"ajax\" && req.http.X-Varnish-Esi-Access == \"private\") {\r\nset resp.http.Cache-Control = \"no-cache\";\r\n}\r\nif (true || client.ip ~ debug_acl) {\r\nset resp.http.X-Varnish-Hits = obj.hits;\r\nset resp.http.X-Varnish-Esi-Method = req.http.X-Varnish-Esi-Method;\r\nset resp.http.X-Varnish-Esi-Access = req.http.X-Varnish-Esi-Access;\r\nset resp.http.X-Varnish-Currency = req.http.X-Varnish-Currency;\r\nset resp.http.X-Varnish-Store = req.http.X-Varnish-Store;\r\n} else {\r\nunset resp.http.X-Varnish;\r\nunset resp.http.Via;\r\nunset resp.http.X-Powered-By;\r\nunset resp.http.Server;\r\nunset resp.http.X-Turpentine-Cache;\r\nunset resp.http.X-Turpentine-Esi;\r\nunset resp.http.X-Turpentine-Flush-Events;\r\nunset resp.http.X-Turpentine-Block;\r\nunset resp.http.X-Varnish-Session;\r\nunset resp.http.X-Varnish-Host;\r\nunset resp.http.X-Varnish-URL;\r\nunset resp.http.X-Varnish-Set-Cookie;\r\n}\r\n}\r\n\r\nDoes anybody has an idea?\r\n\r\nWould be very helpful.\r\n"},"comment":{"url":"https://api.github.com/repos/nexcess/magento-turpentine/issues/comments/100172097","html_url":"https://github.com/nexcess/magento-turpentine/issues/779#issuecomment-100172097","issue_url":"https://api.github.com/repos/nexcess/magento-turpentine/issues/779","id":100172097,"user":{"login":"gewaechshaus","id":7628545,"avatar_url":"https://avatars.githubusercontent.com/u/7628545?v=3","gravatar_id":"","url":"https://api.github.com/users/gewaechshaus","html_url":"https://github.com/gewaechshaus","followers_url":"https://api.github.com/users/gewaechshaus/followers","following_url":"https://api.github.com/users/gewaechshaus/following{/other_user}","gists_url":"https://api.github.com/users/gewaechshaus/gists{/gist_id}","starred_url":"https://api.github.com/users/gewaechshaus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gewaechshaus/subscriptions","organizations_url":"https://api.github.com/users/gewaechshaus/orgs","repos_url":"https://api.github.com/users/gewaechshaus/repos","events_url":"https://api.github.com/users/gewaechshaus/events{/privacy}","received_events_url":"https://api.github.com/users/gewaechshaus/received_events","type":"User","site_admin":false},"created_at":"2015-05-08T09:27:39Z","updated_at":"2015-05-08T09:27:39Z","body":"Hey colleagues,\r\n\r\nVarnish doesn't cache any cookies nor any requests with a Set-Cookie header... Try to blacklist checkout/cart URL, exclude the block which spit out the items (f.e. minicart), make sure that the relevant controllers do their job without getting cached.\r\n\r\nhttps://www.varnish-cache.org/docs/3.0/tutorial/cookies.html\r\n\r\n\r\n"}}